We use plain old syslog, configured to log to a remote log host. The connection is secured with TLS and old log files are compressed with LZMA.

Our analysis frontend is plain old SSH, bash, grep and less.