Self-Hosted Alternatives to Papertrail
Why Replace Papertrail?
Papertrail (now owned by SolarWinds) charges based on log volume and retention. Their free tier allows just 50 MB/month with 48-hour search and 7-day archive. Paid plans start at $7/month for 1 GB/month, scaling to $230+/month for 50 GB/month. For any serious logging workload, costs add up fast.
Updated February 2026: Verified with latest Docker images and configurations.
After SolarWinds’ massive 2020 supply chain breach — where attackers compromised their Orion platform and infiltrated thousands of organizations including US government agencies — sending your logs to SolarWinds-owned infrastructure carries real risk. Logs contain hostnames, IP addresses, error details, and sometimes credentials. Self-hosting keeps that data under your control.
Papertrail’s appeal is simplicity: syslog forwarding, tail-like live search, and email alerts. Every self-hosted alternative listed here matches or exceeds those capabilities at zero recurring cost.
Best Alternatives
Grafana Loki — Best Overall Replacement
Loki is the ideal Papertrail replacement for most setups. It’s lightweight, accepts syslog input natively, and pairs with Grafana for a search and alerting experience that surpasses Papertrail’s web UI. Log forwarding from servers uses Promtail — a simple agent similar to what Papertrail requires but without the volume limits.
Unlike Papertrail’s 48-hour search window on the free tier, Loki retains logs as long as you have disk space. No artificial retention limits.
Best for: Teams already using Grafana, or anyone wanting simple log aggregation without per-GB fees.
[Read our full guide: How to Self-Host Loki]
Graylog — Best for Advanced Analysis
Graylog offers full-text search across all your logs — closer to Papertrail’s search experience than Loki’s label-based querying. The web UI includes dashboards, alerting rules, and log pipeline processing. Version 7.0’s DataNode eliminates the old Elasticsearch requirement.
Graylog is heavier than Loki (4+ GB RAM) but provides richer analysis capabilities. If you’re outgrowing Papertrail because you need more than basic search and alerts, Graylog is the logical step up.
Best for: Teams that need Splunk-like capabilities without the Splunk price tag.
[Read our full guide: How to Self-Host Graylog]
Dozzle — Best for Docker Environments
If your infrastructure is Docker-based and you mainly used Papertrail for container log tailing, Dozzle replaces that workflow completely. Connect it to your Docker socket and get instant live log viewing with search, filtering, and multi-host support.
No log forwarding setup, no agents, no configuration files. Just deploy and browse logs. For small to medium Docker deployments, this covers 90% of what Papertrail provided.
Best for: Docker-only environments where live log viewing is the primary need.
[Read our full guide: How to Self-Host Dozzle]
Migration Guide
Exporting from Papertrail
Papertrail archives logs as gzip files in S3 or your own storage:
- Go to Settings → Log Archives in Papertrail
- If S3 archiving is configured, download your archive files
- Each archive is a gzipped syslog file, one per hour
# Extract archived logs
gunzip -r papertrail-archives/
# Archives are standard syslog format, ready for import
head -5 2026-03-01-00.log
# Mar 1 00:00:01 web-01 nginx[1234]: 200 GET /api/healthForwarding to Self-Hosted
Replace Papertrail’s syslog destination with your self-hosted server:
For Graylog — send syslog to port 5140:
# rsyslog config (/etc/rsyslog.d/graylog.conf)
*.* @graylog-server:5140;RSYSLOG_SyslogProtocol23FormatFor Loki — install Promtail and point it at your log files:
# /etc/promtail/config.yml
server:
http_listen_port: 9080
clients:
- url: http://loki-server:3100/loki/api/v1/push
scrape_configs:
- job_name: syslog
static_configs:
- targets: [localhost]
labels:
job: syslog
__path__: /var/log/*.logSetting Up Alerts
Papertrail’s email alerts map directly to Graylog’s alert conditions or Grafana’s alerting rules:
- Graylog: Alerts → Notifications → Create new alert. Define a search query and threshold.
- Grafana + Loki: Alerting → Alert rules → Create. Use LogQL queries with thresholds.
Both support email, Slack, PagerDuty, and webhook notification channels.
Cost Comparison
| Papertrail | Self-Hosted (Loki) | Self-Hosted (Graylog) | |
|---|---|---|---|
| 1 GB/month | $7/month | $0 | $0 |
| 5 GB/month | $35/month | $0 | $0 |
| 25 GB/month | $115/month | $0 | $0 |
| 50 GB/month | $230/month | $0 | $0 |
| Infrastructure | Included | $5–20/month VPS | $15–40/month VPS |
| Search retention | 2 days (free), 7 days (paid) | Unlimited | Unlimited |
| Archive retention | 1 year | Unlimited | Unlimited |
| Annual cost (5 GB/mo) | $420 | $60–240 | $180–480 |
| 3-year cost (5 GB/mo) | $1,260 | $180–720 | $540–1,440 |
What You Give Up
- Zero-setup syslog forwarding — Papertrail’s remote syslog endpoint works instantly. Self-hosted requires configuring rsyslog/Promtail on each server.
- Managed availability — Papertrail handles uptime. Self-hosted means your logging is down when your server is down (unless you replicate).
- Team sharing via URL — Papertrail’s shareable search links are convenient. Grafana offers similar functionality but requires user accounts.
- Mobile-friendly interface — Papertrail’s web UI works well on phones. Grafana and Graylog are desktop-focused.
These are minor inconveniences compared to saving $420+/year and keeping your logs private.
FAQ
Can Loki do full-text search like Papertrail?
Yes, but differently. Papertrail indexes all log content for instant full-text search. Loki indexes only metadata labels (hostname, service name, log level) and stores log content as compressed chunks. You query by labels first, then filter content with regular expressions. For most operational logging — “show me errors from web-01 in the last hour” — Loki is just as fast. For arbitrary string searches across all logs without knowing the source, Loki is slower. If full-text search speed is critical, Graylog indexes everything like Papertrail does.
How do I forward Docker container logs to a self-hosted logging server?
For Loki: install Promtail as a sidecar container and configure it to read Docker’s log files from /var/lib/docker/containers/. Alternatively, use Grafana Alloy or the Docker Loki logging driver for zero-config forwarding. For Graylog: use the Docker GELF logging driver — add logging: { driver: gelf, options: { gelf-address: "udp://graylog:12201" }} to your Docker Compose services. For Dozzle: no forwarding needed — it reads logs directly from the Docker socket in real-time.
Is Dozzle enough to replace Papertrail, or do I need Graylog/Loki?
Depends on your needs. Dozzle provides live log viewing, search, and filtering for Docker containers — this covers 80% of what homelabbers and small deployments use Papertrail for. What Dozzle doesn’t do: long-term log retention (logs disappear when containers restart), alerting, dashboards, or non-Docker log sources. If you need to search yesterday’s logs, set up alerts on error patterns, or aggregate logs from VMs/bare metal servers, you need Graylog or Loki. For real-time Docker troubleshooting only, Dozzle at 50 MB RAM is unbeatable.
How much disk space do self-hosted logs consume?
Rule of thumb: 1 GB of raw syslog per day from a moderately active server. Loki compresses this ~10x, so 1 GB/day raw becomes ~100 MB/day stored. Graylog with full-text indexing uses more — roughly 3-5x the raw log size due to indexing overhead. For a homelab generating 500 MB/day of logs with 30-day retention, budget 5-15 GB for Loki or 50-75 GB for Graylog. Compare to Papertrail’s $35/month for 5 GB/month with 7-day search — self-hosted stores indefinitely at the cost of disk space only.
Can I set up alerts to replace Papertrail’s email notifications?
Yes. Graylog has a built-in alerting system — create conditions (e.g., “more than 5 error messages in 10 minutes”) and configure notification channels (email, Slack, PagerDuty, webhooks). Grafana + Loki uses Grafana Alerting — write LogQL queries with thresholds and route alerts to contact points. Both are more powerful than Papertrail’s alert system, supporting pattern matching, rates, absences, and combinations. Setup takes 15-30 minutes per alert rule vs Papertrail’s one-click approach.
How do I migrate existing Papertrail archives to a self-hosted server?
Papertrail archives logs as gzipped syslog files in S3 (if configured). Download the archive files, decompress them with gunzip, then ingest into your self-hosted platform. For Graylog: send each log line to the GELF HTTP input. For Loki: use Promtail’s static_configs to point at the extracted log files. Realistically, most teams don’t migrate historical logs — they start fresh with the self-hosted server and let Papertrail archives age out.
Can I monitor multiple servers with one self-hosted logging instance?
Yes. All three alternatives support multi-server log aggregation. For Loki: install Promtail on each server, point it at your central Loki instance. For Graylog: configure rsyslog or Filebeat on each server to forward to Graylog’s input ports. For Dozzle: use its multi-host feature to connect to Docker instances on remote servers via TCP. Graylog and Loki handle 10-50 servers on a $15-20/month VPS easily.
Related
Get self-hosting tips in your inbox
Get the Docker Compose configs, hardware picks, and setup shortcuts we don't put in articles. Weekly. No spam.
Comments