Visibility in this ranking can be paid for. Payment moves a vendor's position within the
shortlist; it never adds a vendor, and it never changes a word of the review. The largest vendors in observability and log management software
cannot hold places 1 to 3. Places 1 to 3 go to challengers, vendors outside the best-known brands in a category,
wherever the category has them; the established names follow from place 4 in their ranked order. How it works: placement disclosure ·
editorial process.
The 11 tools, reviewed
#1 Guardsix (formerly LogPoint)
SIEM and security-log management with node-based licensing · Denmark · logpoint.com
SIEM Self-hostable EU sovereignty
Rebranded from LogPoint in March 2026 with the product, contracts and support unchanged, Guardsix is the only tool in this category built log-first specifically for security teams. Node-based licensing avoids the volume-based bill shock common in SIEM, but the price is quoted rather than published and getting full value takes real onboarding work, which makes it a harder start than tools a team can price on its own.
- Pricing: Node-based, quote only. Node-based licensing set by the number of nodes, devices or entities, the products chosen and the support level, across four packages (Govern, Detect, Defend, Respond), quoted on request. Free plan: none.
- Best for: Security teams needing SIEM-grade log retention with predictable licensing
- Strengths: SIEM, NDR and SOAR under one Command Centre; UEBA and NDR start at the Defend package, SOAR at Respond; Self-hosted and air-gappable deployment; Node-based licensing rather than log-volume billing.
Where it falls short
The structured taxonomy and query language require real onboarding investment before a security team gets full value from it, pricing is quoted rather than a published, self-serve number, and the full SIEM, NDR and SOAR stack is only in the top Respond package.
Wrong for
A team whose primary need is general infrastructure or application observability rather than security operations and compliance-grade log retention.
Visit Guardsix (formerly LogPoint) →
#2 Coralogix
Cost-optimized observability that routes data by business value · Israel · coralogix.com
TCO Optimizer Usage-based Full observability
Coralogix's TCO Optimizer routes each log or trace to a High, Medium, Low or blocked processing tier by business value rather than charging one flat rate for everything ingested, which the vendor claims saves 25% to 60% on logs and 50% to 75% on traces depending on the tier, and archived data lands in the customer's own S3 bucket.
- Pricing: Usage-based per GB. Usage-based per GB with all features included, published: logs from $0.42/GB, traces $0.16/GB, metrics $0.06/GB, with no per-host, per-user or per-query charges. Free plan: free trial.
- Best for: Teams that want per-GB cost control without losing high-value log detail
- Strengths: TCO Optimizer routes data by business value to different processing tiers; Logs, metrics and traces in one platform; Claimed savings of 25% to 60% on logs and 50% to 75% on traces, depending on pipeline.
Where it falls short
It is smaller and less recognised than Datadog or Splunk, with a thinner integration ecosystem, and it is sold as a hosted service only, so a team cannot run the platform on its own infrastructure, even though archived data sits in its own S3 bucket.
Wrong for
A buyer that defaults to the largest, best-known brand regardless of cost mechanics, or one that needs to self-host the whole observability platform on its own infrastructure.
Visit Coralogix →
#3 Graylog
Log management with a genuinely uncapped free tier · United States · graylog.org
Free tier, no data cap Log-first US-controlled
Graylog Open is free software with no data-volume cap, which is unusual among log-management vendors, and the licence-key upgrade path to Enterprise or Security keeps the same data rather than forcing a migration. It was founded in Hamburg in 2009, and a German operating subsidiary still exists, though the controlling entity today is Graylog Inc., a Delaware corporation headquartered in Houston, Texas.
- Pricing: Free open tier + published paid floors. Graylog Open is free with no ingest cap. Free plan: free plan.
- Best for: Teams that want a genuinely free log-management starting point
- Strengths: Graylog Open: free, self-hosted, no ingest cap; Smooth licence-key upgrade from Open to Enterprise or Security; Log-first search and alerting.
Where it falls short
The Open edition is source-available under SSPL, not an OSI-approved open source licence, and Enterprise and Security pricing floors start around $15,000 to $18,000 a year, a steep step up from free.
Wrong for
A buyer that specifically requires an OSI-approved open source licence rather than source-available software, or one that wants a hosted service at a published price.
Visit Graylog →
#4 Checkmk
Auto-discovery infrastructure monitoring, 2,000+ checks · Germany · checkmk.com
Auto-discovery Open core PSG Equity-owned
Checkmk's auto-discovery and huge integration library make onboarding a large, undocumented estate faster than hand-configuring one host at a time, and pricing is published rather than quoted across four real tiers.
- Pricing: Open core, published tiers. Community edition free for roughly 100 hosts. Free plan: open source.
- Best for: IT teams onboarding a large, undocumented estate fast
- Strengths: Auto-discovery of hosts, services and network devices; 2,000+ prebuilt integration checks; Rule-based configuration engine.
Where it falls short
The learning curve is steep, the interface is dated, and major version upgrades mean real configuration rework.
Wrong for
A team that wants a modern interface with a gentle learning curve, or one that cannot spare time for configuration rework at each major version upgrade.
Visit Checkmk →
#5 Centreon
Open-source IT and network monitoring, scaling into observability · France · centreon.com
Open core French company Self-hostable
Centreon extends Nagios-lineage infrastructure and network monitoring toward full-stack observability, with a genuine free open-source edition and a no-time-limit IT-100 Freemium tier rather than a crippled trial, and a strong footprint in French public-sector, enterprise and telecom accounts.
- Pricing: Open core, published tiers. Free Centreon Open Source edition and a free IT-100 Freemium tier (the full IT Edition, up to 100 hosts). Free plan: free plan.
- Best for: IT operations teams wanting an open-source monitoring core that scales
- Strengths: Free Centreon Open Source edition plus IT-100 Freemium up to 100 hosts; IT, Business and MSP editions, self-hosted or SaaS; Metrics, logs and business/SLA-level views.
Where it falls short
Published prices cover only entry points: IT and Business start at fixed host counts, while larger estates and the MSP edition need a quote. The interface still reads as dated next to newer cloud-native observability tools, and tracing depth trails dedicated APM specialists.
Wrong for
A team whose main need is deep distributed tracing and application performance monitoring rather than infrastructure and network monitoring.
Visit Centreon →
#6 Zabbix
Free infrastructure monitoring with zero feature gating · Latvia · zabbix.com
Open source Founder-owned No feature gating
Zabbix is entirely free software with no host cap and nothing held back behind a paid tier; the Silver, Gold and Platinum subscriptions buy support, not more product. Founder-owned in Riga for twenty years with no outside investors or acquisitions.
- Pricing: Open source + paid support. The software is entirely free and open source with no host cap. Free plan: open source.
- Best for: Infrastructure teams wanting zero licence cost at any scale
- Strengths: Free, open source (AGPLv3 since version 7.0) with no feature-gated edition; Metrics, network and infrastructure monitoring; Log monitoring via agent log items.
Where it falls short
No native distributed tracing or APM, and log monitoring is agent-based rather than a dedicated search product like Elastic or Guardsix. Self-hosting means owning database tuning and scaling as the estate grows.
Wrong for
A team that needs native distributed tracing, or one that wants a hosted product with nothing to operate.
Visit Zabbix →
#7 Icinga
Nagios-successor monitoring, configured as code · Germany · icinga.com
Open source Configuration as code Free core, paid modules
Icinga is the Nagios-lineage monitoring platform most infrastructure teams outgrow Nagios into, operated by Icinga GmbH within Germany's Netways Group with no outside investors found. The core is free with unlimited hosts, though a few Enterprise modules and the packaged builds for RHEL, SLES and Amazon Linux sit behind paid subscriptions, so the free path suits teams able to build from source or use community packages.
- Pricing: Open source + paid subscriptions. Free, open source core with unlimited hosts. Free plan: open source.
- Best for: Teams that want monitoring configured as code on a free, uncapped core
- Strengths: Free, open source core with unlimited hosts and services; Configuration as code; Nagios plugin compatibility.
Where it falls short
The plugin and integration ecosystem is smaller than the Nagios lineage it forked from, self-hosting is the only deployment option, and it monitors state and metrics first, with logs and cloud coverage as an addition rather than the core product.
Wrong for
A team that wants a hosted SaaS product with nothing to run themselves, or a click-first configuration experience rather than code-first.
Visit Icinga →
#8 Dynatrace
Automatic dependency mapping and a unified data lakehouse · United States · dynatrace.com
Full-stack APM Auto-instrumentation Unified data lakehouse
Dynatrace earns its place when the estate is too big to map by hand: one agent per host builds the dependency graph automatically, and Grail keeps logs, metrics, traces and business events in one queryable store instead of three separate products. It was founded in Linz in 2005 and its engineering headquarters is still there, but the corporate headquarters is in Boston.
- Pricing: Annual commitment, consumption rate card. An annual platform commitment drawn down at published rate-card prices, such as $58/month per 8 GiB host for Full-Stack Monitoring, $29/month per host for Infrastructure Monitoring and $0.20 per GiB of logs ingested. Free plan: free trial.
- Best for: Large estates nobody fully documented, where auto-discovery pays
- Strengths: OneAgent automatic dependency mapping; Grail unified data lakehouse for logs, metrics, traces and events; AI-assisted root-cause analysis.
Where it falls short
Consumption pricing across hosts, ingest and retention is difficult to forecast before running it, and the strongest features assume the proprietary OneAgent rather than a plain OpenTelemetry collector.
Wrong for
A small team that wants a month-to-month plan rather than an annual platform commitment, or one that has standardized on a vendor-neutral OpenTelemetry pipeline and does not want the strongest features locked behind a proprietary agent.
Visit Dynatrace →
#9 Elastic Observability
Log-first observability built on the ELK stack · Netherlands · elastic.co
Self-hostable Log-first architecture Search-based
Elastic Observability grew directly out of Elasticsearch, Logstash and Kibana, which makes it log-first at its core, like Graylog, rather than a metrics-first tool with logs added later, and it can be fully self-hosted for a real exit from the vendor.
- Pricing: Usage, resource or node-based + open source. Elastic Cloud Serverless bills observability per GB ingested and per GB retained, at published rates. Free plan: open source.
- Best for: Teams that want logs, metrics and traces correlated in one searchable index
- Strengths: One searchable index for logs, traces and metrics; Fully self-hostable, including the open source core; AGPL v3-licensed Elasticsearch and Kibana since 2024.
Where it falls short
A buyer is operating a search cluster: shard counts, index lifecycle and retention tiers decide both performance and cost, which is a specialism most teams do not already have.
Wrong for
A team that wants a fully managed product with nothing to tune, or one that cannot staff the shard, index lifecycle and retention work a search cluster needs.
Visit Elastic Observability →
#10 Sumo Logic
Log analytics and Cloud SIEM priced on consumption credits · United States · sumologic.com
Log analytics Cloud SIEM Flex credit pricing
Sumo Logic's Flex licensing, on its Enterprise Suite plan, charges nothing for ingest and bills search separately, which suits a high-volume, low-query workload, like compliance logs, that plain per-GB-ingested pricing punishes, and the same plan offers Cloud SIEM and SOAR alongside observability.
- Pricing: Flex consumption credits. Two published plans, Essentials and Enterprise Suite, paid in Sumo credits and quoted. Free plan: free trial.
- Best for: High-volume, low-query workloads that flat per-GB pricing punishes
- Strengths: Cloud-native log analytics and observability; Cloud SIEM and Cloud SOAR in Enterprise Suite, on activation; Flex licensing on Enterprise Suite: $0 ingest, search billed separately.
Where it falls short
The credit-based model is genuinely harder to forecast than a flat per-GB number, and taken private by Francisco Partners in 2023, the company's product direction is less publicly visible than when it was listed.
Wrong for
A buyer who wants a single, easily forecast monthly bill rather than a credit system with several moving parts.
Visit Sumo Logic →
#11 LogicMonitor
Hybrid infrastructure monitoring with AIOps event intelligence · United States · logicmonitor.com
Agentless-first Hybrid IT/cloud AIOps (Edwin AI)
LogicMonitor covers on-prem, network and cloud infrastructure from one agentless-first platform, which is the classic NOC and IT-ops job that Datadog and New Relic cover less deeply, and Edwin AI adds automated event correlation on top.
- Pricing: Hybrid Units, per-unit. Hybrid Units at starting monthly list prices of $16 (LM Essentials), $27 (LM Advanced) and $53 (LM Signature + Edwin AI) per unit. Free plan: free trial.
- Best for: Classic NOC and IT-ops teams monitoring on-prem, network and cloud together
- Strengths: Agentless-first discovery across on-prem, network and cloud; Edwin AI event correlation and AIOps; Hybrid Units pricing model since September 2025.
Where it falls short
Modern application-layer APM, distributed tracing and high-cardinality workloads are not its strength; its heritage is IT-operations monitoring rather than observability-native design.
Wrong for
A team whose main need is deep application performance monitoring or distributed tracing rather than infrastructure and network visibility.
Visit LogicMonitor →
Questions and answers
What is the best observability and log management software in 2026?
Guardsix (formerly LogPoint) ranks first of 11, best for security teams needing SIEM-grade log retention with predictable licensing. Coralogix is second (teams that want per-GB cost control without losing high-value log detail) and Graylog third (teams that want a genuinely free log-management starting point). Places 1 to 3 go to challengers, vendors outside the best-known brands, wherever the category has them.
Which of these tools are free to use?
Zabbix is free, open-source software with no host cap and no feature gating at any scale; its paid tiers buy support, not more product.
Where are these vendors headquartered, and who controls them?
Guardsix is in Denmark, majority-owned by Sweden's Summa Equity; Centreon is in France, majority French-owned; Zabbix is in Latvia, founder-owned; and Icinga is in Germany, part of the Netways Group.
Is Graylog a German or a US company?
Both, in different senses. Graylog was founded in Hamburg in 2009, and a German operating subsidiary, Graylog Germany GmbH, still exists.
What happened to LogPoint?
LogPoint rebranded to Guardsix in March 2026.
Which tool is best for security-grade log management or SIEM?
Guardsix is the only tool in this category built specifically as a converged SIEM, SOAR, UEBA and network-detection platform rather than general infrastructure or application observability.
Which of these tools can you self-host?
Elastic Observability, Guardsix, Centreon, Zabbix, Icinga, Graylog and Checkmk all offer a genuine self-hosted or on-premises deployment, several with a free open-source core, and Dynatrace offers a self-run Dynatrace Managed cluster alongside its SaaS.
How does ingest-based pricing actually work in this category?
Most vendors here charge by the volume of data ingested per day or month, in gigabytes, sometimes combined with a retention multiplier or a per-host component.
Do any of these tools include AIOps or automated root-cause analysis?
Dynatrace's automatic dependency mapping and LogicMonitor's Edwin AI both add automated correlation and root-cause suggestions on top of raw telemetry.
Why isn't Dash0 on this list?
Dash0 was founded in Germany in 2023 and is now legally Dash0 Inc., headquartered in New York, after a $110 million Series B round in March 2026.
How often is this ranking updated?
Whenever a fact underneath it changes: a pricing update, an acquisition, a rebrand like LogPoint becoming Guardsix, or a change in controlling ownership like Checkmk's 2025 majority stake sale.
