As I mentioned a while ago, I use and love splunk. I had bemoaned the fact that the Splunk 4 “Free” Edition wasn’t yet available. It is now. Go get it. I’ll wait. In 4, they have really upped the scale and speed of log ingestion, indexing and searching. My log server is a single core AMD Sempron box with 1 GB of RAM, and it’s wicked fast. Noticeably faster on the same hardware than 3 was. It’s not often a vendor ships faster products than previous iterations.