Observability and log management software ingests logs, metrics and traces from running infrastructure and applications so a team can search, correlate and alert on them in one place, rather than piecing together evidence from separate tools during an incident. This ranking is aimed at teams choosing a data platform for logs, metrics and traces, or a dedicated log-management and SIEM specialist — not at buyers comparing uptime checks or a single-language APM agent. We judged where the data actually lives, what the ingest bill becomes at real volume, whether SIEM-grade retention is available for security teams that need it, and, deliberately, which company or jurisdiction ultimately controls the product — a question that turned out to have a less predictable answer than each vendor's founding story suggests.
Visibility in this ranking can be paid for. Payment moves a vendor's position within the
shortlist; it never adds a vendor, and it never changes a word of the review. The largest vendors in observability and log management software
cannot hold places 1 to 3. How it works: placement disclosure ·
editorial process.
How we ranked these
Where the data actually lives
Seven of the eleven tools in this category offer a genuine self-hosted or on-premises deployment: Elastic Observability, Guardsix, Centreon, Zabbix, Icinga, Graylog and Checkmk all let a buyer run the platform on its own infrastructure, in full or as an open-source core. Sumo Logic, Coralogix, LogicMonitor and Dynatrace are hosted-only, which means the question of where telemetry sits, and who can be compelled to hand it over, is answered entirely by the vendor's own infrastructure choices rather than the customer's.
What the real ingest bill becomes
The number on a pricing page rarely survives contact with real telemetry volume. Dynatrace and Elastic Observability price on consumption — hosts, GiB ingested, retention — which is honest but hard to forecast before a trial with real traffic. Sumo Logic's Flex credits and Coralogix's TCO Optimizer both try to decouple ingest cost from search cost, an increasingly common answer to the same complaint: flat per-GB pricing punishes exactly the high-volume, low-query logs a compliance team is required to keep. Zabbix, Icinga and Graylog Open remove the ingest question entirely by charging nothing for the software itself.
Independence from the vendor: who actually controls the product
This is the test that moved the most names in this category. Checkmk, Dash0 and Graylog all have genuine German engineering roots, but researching current ownership in 2026 produced three different answers: Checkmk's legal headquarters remains Munich even after PSG Equity, a US growth-equity firm, bought a majority stake in February 2025; Dash0 is now legally Dash0 Inc., headquartered in New York, despite its 2023 German founding; and Graylog's controlling entity is Graylog Inc., a Delaware corporation headquartered in Houston, Texas, with its Hamburg operation now a subsidiary rather than the parent. A founding story does not settle who can be compelled to hand data over today.
Who it's for: three shapes of buyer, not one
A team building a full-stack data platform for logs, metrics and traces across a large estate is shopping in a different aisle than a security team needing SIEM-grade retention, which is again different from an IT-operations team that mainly needs infrastructure and network monitoring at a predictable, or zero, licence cost. Dynatrace and Elastic Observability answer the first question; Guardsix and, to an extent, Sumo Logic answer the second; Checkmk, Centreon, Zabbix and Icinga answer the third. Buying the wrong shape for the job is the most common regret in this category.
The 11 tools, reviewed
#1 Guardsix (formerly LogPoint)
SIEM and security-log management with an EU-sovereignty focus · Denmark · logpoint.com
SIEM Self-hostable EU sovereignty
Rebranded from LogPoint in March 2026 with the product, contracts and support unchanged, Guardsix is the only tool in this category built log-first specifically for security teams. Node-based licensing avoids the volume-based bill shock common in SIEM, and both the operating company (Denmark) and its majority owner, Summa Equity (Sweden), sit inside the EU.
Where it falls short
The structured taxonomy and query language require real onboarding investment before a security team gets full value from it, and pricing is quoted rather than a published, self-serve number.
Wrong for
A team whose primary need is general infrastructure or application observability rather than security operations and compliance-grade log retention.
Pricing: Node-based licensing by the number and type of infrastructure nodes reporting in, quoted on request; marketed as more predictable than pure log-volume SIEM pricing. (no free tier)
Visit Guardsix (formerly LogPoint) →
#2 Coralogix
Cost-optimized observability that routes data by business value · Israel · coralogix.com
TCO Optimizer Usage-based Full observability
Coralogix's TCO Optimizer routes each log or trace to a High, Medium, Low or blocked processing tier by business value rather than charging one flat rate for everything ingested, which the vendor claims saves roughly 25% on logs and 50% on traces against flat indexing.
Where it falls short
It is smaller and less recognised than Datadog or Splunk, with a thinner integration ecosystem, and it is Israeli-founded and controlled, not European, for buyers where that distinction matters.
Wrong for
A buyer that defaults to the largest, best-known brand regardless of cost mechanics, or one that specifically requires a European-controlled vendor.
Pricing: Usage and ingestion-based per GB across logs, metrics and traces, published; no per-host, per-user or per-query charges. An S3 archive tier runs at roughly $0.003/GB effective with compression. (free tier available (limited daily volume))
Visit Coralogix →
#3 Graylog
Log management with a genuinely uncapped free tier · United States · graylog.org
Free tier, no data cap Log-first US-controlled
Graylog Open is free software with no data-volume cap, which is unusual among log-management vendors, and the licence-key upgrade path to Enterprise or Security keeps the same data rather than forcing a migration. It was founded in Hamburg in 2009, and a German operating subsidiary still exists.
Where it falls short
The controlling entity is Graylog Inc., a Delaware corporation headquartered in Houston, Texas, backed by US growth-equity investors, so Hamburg is now an engineering site rather than the parent company. The Open edition is source-available under SSPL, not an OSI-approved open source licence, and Enterprise/Security pricing floors start around $15,000–$18,000 a year.
Wrong for
A buyer that specifically requires an OSI-approved open source licence rather than source-available software, or one that requires the controlling company to sit inside the EU.
Pricing: Graylog Open is free with unlimited ingest. Graylog Cloud Operations starts around $1,250/month for 10GB/day; Cloud Security around $1,550/month. Self-hosted Enterprise starts from $15,000/year, Security from $18,000/year. (graylog open, unlimited ingest)
Visit Graylog →
#4 Checkmk
Auto-discovery infrastructure monitoring, 2,000+ checks · Germany · checkmk.com
Auto-discovery Open core PSG Equity-owned
Checkmk's auto-discovery and huge integration library make onboarding a large, undocumented estate faster than hand-configuring one host at a time, and pricing is published rather than quoted across four real tiers.
Where it falls short
PSG Equity, a US growth-equity firm, acquired a majority stake in February 2025, so while the legal headquarters remains Munich, control now runs partly through a US investor. The learning curve is steep, the interface is dated, and major version upgrades mean real configuration rework.
Wrong for
A buyer who requires the controlling company, not just the legal headquarters, to be fully EU-owned.
Pricing: Community edition free for roughly 100 hosts; Pro from €190/month (about €1.90/host); Ultimate from €275/month (about €2.75/host); Cloud (SaaS) from €240/month (about €7.20/host), all published. (community edition (~100 hosts))
Visit Checkmk →
#5 Centreon
Open-source IT and network monitoring, scaling into observability · France · centreon.com
Open core French company Self-hostable
Centreon extends Nagios-lineage infrastructure and network monitoring toward full-stack observability, with a genuine free, self-hosted IT Edition rather than a crippled trial, and a strong footprint in French public-sector, enterprise and telecom accounts.
Where it falls short
There is no self-serve pricing above the free tier; every paid edition requires a sales conversation. The interface still reads as dated next to newer cloud-native observability tools, and tracing depth trails dedicated APM specialists.
Wrong for
A buyer that wants a self-serve published price without a sales call.
Pricing: Free, open-source IT Edition self-hosted with a capped feature set; Business, MSP and Cloud editions are custom-quoted by host and device count. (it edition (self-hosted, capped))
Visit Centreon →
#6 Zabbix
Free infrastructure monitoring with zero feature gating · Latvia · zabbix.com
Open source Founder-owned No feature gating
Zabbix is entirely free software with no host cap and nothing held back behind a paid tier; the Silver, Gold and Platinum subscriptions buy support, not more product. Founder-owned in Riga for twenty years with no outside investors or acquisitions.
Where it falls short
No native distributed tracing or APM, and log monitoring is agent-based rather than a dedicated search product like Elastic or Guardsix. Self-hosting means owning database tuning and scaling as the estate grows.
Wrong for
A team that needs native distributed tracing, or one that wants a hosted product with nothing to operate.
Pricing: The software is entirely free and open source with no host cap. Paid support subscriptions are Silver from $325, Gold from $825, Platinum custom; Zabbix Cloud is priced by monitored values per second. (open source, unlimited)
Visit Zabbix →
#7 Icinga
Nagios-successor monitoring, configured as code · Germany · icinga.com
Open source Configuration as code No feature gating
Icinga is the Nagios-lineage monitoring platform most infrastructure teams outgrow Nagios into, operated within Germany's Netways Group with no external or non-EU investors found. Every feature in the core is free with nothing withheld behind a paid tier.
Where it falls short
The plugin and integration ecosystem is smaller than the Nagios lineage it forked from, self-hosting is the only deployment option, and it monitors state and metrics first, with logs and cloud coverage as an addition rather than the core product.
Wrong for
A team that wants a hosted SaaS product with nothing to run themselves, or a click-first configuration experience rather than code-first.
Pricing: Fully free, open source (GPL) core. Paid subscriptions, sold via Netways, cover packaged builds on RHEL, SLES or Amazon Linux and select enterprise modules; a Developer tier covers environments up to 20 hosts. (open source, unlimited)
Visit Icinga →
#8 Dynatrace
Automatic dependency mapping and a unified data lakehouse · Austria · dynatrace.com
Austrian company Auto-instrumentation Unified data lakehouse
Dynatrace earns its place when the estate is too big to map by hand: one agent per host builds the dependency graph automatically, and Grail keeps logs, metrics, traces and business events in one queryable store instead of three separate products. Founded and still engineered in Linz, its Austrian headquarters is genuine despite the New York Stock Exchange listing.
Where it falls short
Consumption pricing across hosts, ingest and retention is difficult to forecast before running it, and the strongest features assume the proprietary OneAgent rather than a plain OpenTelemetry collector. The product is sold and implemented in a way that expects a procurement process rather than self-serve signup.
Wrong for
A small team wanting a price before a sales call, or one that has standardized on a vendor-neutral OpenTelemetry pipeline and does not want the strongest features locked behind a proprietary agent.
Pricing: Consumption-based per host hour and per GiB ingested; rates are published but the total resists forecasting before a trial with real traffic. (15-day free trial, no permanent free tier)
Visit Dynatrace →
#9 Elastic Observability
Log-first observability built on the ELK stack · Netherlands · elastic.co
Self-hostable Log-first architecture Search-based
Elastic Observability grew directly out of Elasticsearch, Logstash and Kibana, which makes it the one genuinely log-first platform in this category rather than a metrics-first tool with logs added later, and it can be fully self-hosted for a real exit from the vendor.
Where it falls short
A buyer is operating a search cluster: shard counts, index lifecycle and retention tiers decide both performance and cost, which is a specialism most teams do not already have. Elastic N.V.'s Dutch incorporation sits alongside executive leadership and its largest office based in the United States, and its licence direction has changed twice in five years.
Wrong for
A team that wants a fully managed product with nothing to tune, or one that treats EU incorporation alone as sufficient evidence of EU control.
Pricing: Consumption-based on ingest volume and retention period, published rates; a fully self-managed deployment can also run on the free, open source core. (free self-managed tier)
Visit Elastic Observability →
#10 Sumo Logic
Log analytics and Cloud SIEM priced on consumption credits · United States · sumologic.com
Log analytics Cloud SIEM Flex credit pricing
Sumo Logic's Flex model separates the cost of ingesting data from the cost of searching and storing it, which suits a high-volume, low-query workload, like compliance logs, that plain per-GB-ingested pricing punishes, and it bundles genuine SIEM and SOAR alongside observability.
Where it falls short
The credit-based model is genuinely harder to forecast than a flat per-GB number, and taken private by Francisco Partners in 2023, the company's product direction is less publicly visible than when it was listed.
Wrong for
A buyer who wants a single, easily forecast monthly bill rather than a credit system with several moving parts.
Pricing: Five plans from Free to Enterprise Suite on a Flex consumption-credit model; credits list at roughly $0.15–$0.36 each. Cloud SIEM ingestion is priced separately at 40 credits per GB. (free plan available)
Visit Sumo Logic →
#11 LogicMonitor
Hybrid infrastructure monitoring with AIOps event intelligence · United States · logicmonitor.com
Agentless-first Hybrid IT/cloud AIOps (Edwin AI)
LogicMonitor covers on-prem, network and cloud infrastructure from one agentless-first platform, which is the classic NOC and IT-ops job that Datadog and New Relic cover less deeply, and Edwin AI adds automated event correlation on top.
Where it falls short
Modern application-layer APM, distributed tracing and high-cardinality workloads are not its strength; its heritage is IT-operations monitoring rather than observability-native design.
Wrong for
A team whose main need is deep application performance monitoring or distributed tracing rather than infrastructure and network visibility.
Pricing: Hybrid Units pricing from $16 per unit per month, billed annually, across three package tiers (LM Essentials, LM Advanced, LM Signature), with Edwin AI as an add-on. (no free tier)
Visit LogicMonitor →
What the data says about this market
Ownership in this category shifted more than most in the twelve months before this guide was written. Checkmk sold a majority stake to US growth-equity firm PSG Equity in February 2025; Sumo Logic and New Relic were both taken private by Francisco Partners in 2023; and LogPoint rebranded to Guardsix in March 2026 under its majority owner, Sweden's Summa Equity, explicitly repositioning around European data sovereignty. Of the eleven vendors ranked here, seven have a genuine EU or EEA legal headquarters (Dynatrace in Austria, Elastic Observability in the Netherlands, Guardsix in Denmark, Checkmk in Germany, Centreon in France, Zabbix in Latvia and Icinga in Germany); three are US-controlled (Sumo Logic, LogicMonitor, Graylog); and one, Coralogix, is Israeli.
Pricing has split into three distinct models rather than converging on one. Consumption-based pricing on ingest volume (Dynatrace, Elastic Observability, Coralogix) remains the default for full-stack platforms. Credit or unit-based abstractions (Sumo Logic's Flex, LogicMonitor's Hybrid Units) are a newer attempt to decouple the bill from a single meter. And genuinely free, uncapped open-source software (Zabbix, Icinga, Graylog Open) sits at the other extreme, with paid tiers there buying support rather than more functionality — a higher proportion of true zero-licence-cost options than most SaaS-heavy software categories carry.
ICT services have grown faster as a share of global trade than most other service categories, from 9.1% of world service exports in 2013 to 14.48% in 2023, with the European Union's share rising even further, from 10.58% to 17.55% over the same period (World Bank). Observability and log management sits underneath a meaningful slice of that growth: almost no software or IT service traded across borders runs without some form of logging and monitoring behind it, and the emergence of EU-controlled specialists like Guardsix, explicitly marketed around data sovereignty, is a concrete sign of European buyers treating jurisdiction as a genuine purchasing criterion rather than a footnote.
The 11 ranked vendors, counted
- Headquarters by region: Europe 7, North America 3, Middle East & Africa 1
- By country: United States 3, Germany 2, Austria 1, Denmark 1, France 1, Israel 1, Latvia 1, Netherlands 1
- Pricing model: Open source + paid support 2, Consumption-based 1, Consumption-based + open source 1, Flex consumption credits 1, Free open tier + published paid floors 1, Hybrid Units, per-unit 1, Node-based, quote only 1, Open core + quote only 1, Open core, published tiers 1, Usage-based per GB 1
- Free option: No free tier 2, Open source, unlimited 2, 15-day free trial, no permanent free tier 1, Community edition (~100 hosts) 1, Free plan available 1, Free self-managed tier 1, Free tier available (limited daily volume) 1, Graylog Open, unlimited ingest 1, IT Edition (self-hosted, capped) 1
Counted from the 11 vendors on this page. More in our market data.
For the wider market behind observability and log management software, read our report The Global Shift to ICT Services,
or browse all industry reports.
Questions and answers
What is the best observability and log management software in 2026?
Dynatrace leads this ranking: Grail, its unified data lakehouse, keeps logs, metrics, traces and business events queryable together, and a single agent per host builds a dependency map automatically. Elastic Observability is the better pick for a team that wants a self-hostable, log-first store built on the ELK stack, and Guardsix suits a security team that specifically needs SIEM-grade retention with predictable, node-based licensing.
Which of these tools are free to use?
Zabbix and Icinga are free, open-source software with no host cap and no feature gating at any scale — paid tiers there buy support, not more product. Graylog Open is also free with no data-volume cap, though under a source-available licence (SSPL) rather than an OSI-approved open source one. Centreon's IT Edition and Checkmk's Community edition are free, self-hosted, open-core editions with a capped feature set.
Which of these vendors are genuinely EU-controlled, not just EU-founded?
Dynatrace (Austria), Guardsix (Denmark, majority-owned by Sweden's Summa Equity), Centreon (France, majority French-owned), Zabbix (Latvia, founder-owned) and Icinga (Germany, owned by the Netways Group) are all both EU-headquartered and EU-controlled. Elastic Observability is Dutch-incorporated (Elastic N.V.) but its executive leadership and largest office lean US. Checkmk keeps a German legal headquarters but PSG Equity, a US growth-equity firm, acquired a majority stake in February 2025. Sumo Logic, LogicMonitor and Graylog are all US-controlled, and Coralogix is Israeli.
Why is Graylog listed as US-controlled despite being founded in Germany?
Graylog was founded in Hamburg in 2009, and a German operating subsidiary, Graylog Germany GmbH, still exists. But the controlling legal entity is Graylog Inc., a Delaware corporation headquartered in Houston, Texas, backed by US growth-equity investors including Harbert Growth Partners and Piper Sandler Merchant Banking. Hamburg is now an engineering and operating site, not the parent company that controls the product.
What happened to LogPoint?
LogPoint rebranded to Guardsix in March 2026. The product, contracts, support and Copenhagen headquarters are unchanged; the company describes the rebrand as closer alignment with managed security service providers and regulated organizations, and it remains majority-owned by Summa Equity, a Stockholm-headquartered investment firm.
Which tool is best for security-grade log management or SIEM?
Guardsix is the only tool in this category built specifically as a converged SIEM, SOAR, UEBA and network-detection platform rather than general infrastructure or application observability. Sumo Logic also bundles genuine Cloud SIEM and SOAR alongside its observability product, and both Elastic Observability and Graylog can serve security use cases with more configuration.
Which of these tools can you self-host?
Elastic Observability, Guardsix, Centreon, Zabbix, Icinga, Graylog and Checkmk all offer a genuine self-hosted or on-premises deployment, several with a free open-source core. Sumo Logic, Coralogix, LogicMonitor and Dynatrace are sold as a hosted service only.
How does ingest-based pricing actually work in this category?
Most vendors here charge by the volume of data ingested per day or month, in gigabytes, sometimes combined with a retention multiplier or a per-host component. Sumo Logic's Flex model and Coralogix's TCO Optimizer both try to separate the cost of storing and searching data from the cost of simply ingesting it, which matters most for high-volume, low-query logs like compliance or audit trails that a flat per-GB rate punishes disproportionately.
Do any of these tools include AIOps or automated root-cause analysis?
Dynatrace's automatic dependency mapping and LogicMonitor's Edwin AI both add automated correlation and root-cause suggestions on top of raw telemetry. Coralogix's TCO Optimizer applies a related idea to cost rather than diagnosis, automatically routing data by business value rather than a human choosing a retention policy by hand.
Why isn't Dash0 on this list despite its German origin?
Dash0 was founded in Germany in 2023, but its current legal entity is Dash0 Inc., headquartered in New York, following a $110 million Series B round in March 2026. That makes it US-controlled by the same standard applied to every other exclusion in this category, regardless of where its engineering team is based.
How often is this ranking updated?
Whenever a fact underneath it changes: a pricing update, an acquisition, a rebrand like LogPoint becoming Guardsix, or a change in controlling ownership like Checkmk's 2025 majority stake sale. The published and last-reviewed dates at the top of this guide are real, and a review means someone checked the vendor's current documentation and legal notices, not that a date was moved forward without a re-check.
