ZSTD Dictionary compression (15:1–20:1) + Merkle-Tree integrity proof. systemd-Timer ready. Free auditor verify binary.
Compare your current gzip + S3 Standard costs against fltlog with ZSTD 15:1 + S3 Glacier over the full compliance retention period.
| Volume / day | Duration | gzip + S3 Standard | ZSTD 15:1 + S3 Glacier | Savings |
|---|---|---|---|---|
| 5 GB | 6 years | $18,000 | ~$170 | $17,830 |
| 15 GB | 6 years | $54,000 | ~$500 | $53,500 |
| 50 GB | 6 years | $180,000 | ~$1,670 | $178,330 |
Most organizations archive logs — but leave critical compliance and cost problems unaddressed.
gzip reaches 10:1 on structured log text. ZSTD with a trained dictionary reaches 15:1 to 20:1 on the same files — same compliance, dramatically less storage cost over six-year retention periods.
An attacker with S3 write access can delete individual log entries and recalculate the file checksum. A Merkle-Tree over every log entry makes individual-entry manipulation detectable — even after the fact.
Your auditor requires a cryptographic Merkle proof with an RFC 3161 timestamp — not a hash stored in a README file. Without this, your archive cannot prove that a specific log line was present on a specific date.
A purpose-built compliance log archiver — not a general-purpose backup tool.
Train a shared dictionary on representative log samples. Compression ratios of 15:1 to 20:1 for structured log formats including JSON, syslog, and nginx access logs.
Every log entry is hashed individually. The tree root covers the complete archive. Deletion or modification of any single entry invalidates the root hash and is immediately detectable.
Publish the Merkle root to S3 Object Lock (WORM), embed it in a printable QR-Code, or write it to an external notary. Root anchoring is independent of the archive storage location.
Request a cryptographic timestamp from a public or enterprise TSA at archive creation time. The timestamp binds archive content to a verifiable point in time accepted in legal proceedings.
Drop-in postrotate hook for logrotate. Ready-made systemd Timer unit for scheduled archiving. No daemon required — fltlog runs as a one-shot process with zero persistent footprint.
Reads plain text, gzip, bzip2, zstd, lz4, and xz compressed logs. Accepts rotated log files from nginx, Apache, syslog, journald, and application-specific formats.
Distribute the standalone verify binary to auditors at no cost. Verifiers can confirm Merkle-Tree integrity and RFC 3161 timestamp without a fltlog license or internet access.
Generate a signed, dated PDF containing the archive manifest, entry count, date range, Merkle root, and TSA certificate chain. Ready to hand to an auditor or attach to a compliance filing.
fltlog is designed around the specific text of each regulation — not a generic “compliance-friendly” claim.
Retain audit logs for at least 12 months with a minimum of 3 months immediately available. Tamper detection is mandatory. fltlog satisfies all three requirements: retention period, fast-access tiering, and Merkle-Tree manipulation detection.
Activity logs for electronic protected health information must be retained for 6 years from the date of creation or last use. fltlog archives to S3 Glacier with WORM tagging and produces a verifiable integrity trail for the full retention window.
Records relevant to audit must be retained for 7 years. WORM storage is explicitly recommended to prevent alteration. fltlog supports S3 Object Lock, Azure Immutable Blob, and on-premises WORM targets with RFC 3161 timestamp receipts.
Purpose-built compliance archiving at a fraction of the cost of general-purpose log management platforms.
| Feature | gzip + S3 | Splunk ~$0.88 / GB |
Cribl ~$0.27 / GB (routing, no archive) |
AWS CloudWatch | fltlog €49 / Mo |
|---|---|---|---|---|---|
| ZSTD Compression | × | Partial | Routing only | × | ✓ 15:1–20:1 |
| Merkle-Tree Integrity | × | × | × | × | ✓ |
| Compliance Archiving | Manual | ✓ | × | Partial | ✓ |
| Forensic PDF Report | × | Add-on | × | × | ✓ Included |
| CLI-First / No Agent | ✓ | × | × | × | ✓ |
Simple per-server monthly pricing. No per-GB ingestion fees. No agent seats.
Annual subscription: 15% discount
Annual subscription: 15% discount
Common questions from security engineers and compliance officers.
fltlog-verify binary is distributed free of charge and without a license requirement. Auditors can run it on their own systems to verify the Merkle-Tree root hash, confirm the RFC 3161 timestamp, and validate that a specific log entry is present and unmodified. The verify binary has no external dependencies and does not connect to limes datentechnik servers.
postrotate hook for logrotate that archives the rotated file immediately after rotation. It also ships a systemd service and timer unit for scheduled archiving independent of logrotate. Both integration paths run fltlog as a one-shot process — there is no persistent daemon or agent process.