ossec + syslog , how you display the data (zabbix, elk, etc) is up to you.