syslog-ng

syslog-ng supports a wide variety of protocols to receive or send log data. While its origins are in syslog, today it supports modern, cloud native transports such as OpenTelemetry (OTLP), Google PubSub or Kafka. syslog-ng interoperates with a variety of devices, and is capable of consuming and transforming data between various sources and destinations.

Extensions to the original syslog-ng protocol include:

• ISO 8601 timestamps with millisecond granularity and time zone information
• The addition of the name of relays in additional host fields, to make it possible to track the path of a given message
• Reliable transport using TCP
• TLS encryption (Since 3.0.1 in OSE {{cite web |url=http://www.balabit.com/downloads/files/syslog-ng/open-source-edition/3.0.1/changelog-en.txt

| title=Changelog 3.0.1

| accessdate=2009-01-21

}})

The syslog-ng project began in 1998, when Balázs Scheidler, the primary author of syslog-ng, ported the existing nsyslogd code to Linux. The 1.0.x branch of syslog-ng was still based on the nsyslogd sources and are available in the syslog-ng source archive. {{cite web |url=https://www.linux.com/news/interview-syslog-ng-20-developer-balazs-scheidler/

| title=Interview: syslog-ng 2.0 developer Balázs Scheidler

| accessdate=2024-07-31

}}

Right after the release of syslog-ng 1.0.x, a reimplementation of the code base started to address some of the shortcomings of syslog and to address the licensing concerns of Darren Reed, the original syslog author. This reimplementation was named stable in the October 1999 with the release of version 1.2.0. This time around, syslog-ng depended on some code originally developed for lsh by Niels Möller.

Three major releases (1.2, 1.4 and 1.6) were using this code base, the last release of the 1.6.x branch in February 2007. In this period of about 8 years, syslog-ng became one of the popular alternative syslog implementations.

In a volunteer based effort, yet another rewrite was started back in 2001, dropping lsh code and using the more widely available GLib library. This rewrite of the codebase took its time, the first stable release of 2.0.0 happened in October 2006.

Development efforts were focused on improving the 2.0.x branch; support for 1.6.x was dropped at the end of 2007. Support for 2.x was dropped at the end of 2009, but it is still used in some Linux distributions.{{cite web |url=http://packages.qa.debian.org/s/syslog-ng.html|title=Debian syslog-ng package| accessdate=2011-11-11}}{{cite web |title=SLES syslog-ng documentation |url=http://ocw.novell.com/suse-linux-enterprise-server-administrators/upgrading-to-certified-linux-professional-10/3070_07_manual.pdf |archive-url=https://web.archive.org/web/20110813082407/http://ocw.novell.com/suse-linux-enterprise-server-administrators/upgrading-to-certified-linux-professional-10/3070_07_manual.pdf |archive-date=2011-08-13 |accessdate=2011-11-11}} Balabit, the company behind syslog-ng, started a parallel, commercial fork of syslog-ng, called syslog-ng Premium Edition. Portions of the commercial income are used to sponsor development of the free version.

Syslog-ng version 3.0 was released in the fourth quarter of 2008.

Starting with the 3.0 version developments efforts were parallel on the Premium and on the Open Source Editions. PE efforts were focused on quality, transport reliability, performance and encrypted log storage. The Open Source Edition efforts focused on improving the flexibility of the core infrastructure to allow more and more different, non-syslog message sources.

The syslog-ng 3.X series brought many major changes to syslog-ng without breaking backwards compatibility. Syslog-ng became modular and multi-threaded. Support for various document stores and message queuing systems was added. Many message types are now automatically parsed and turned into name-value-pairs. Extending syslog-ng using Java and Python became possible.

Version 4.0 of syslog-ng was released in December, 2022. The main version number change was necessary due to a major change in type support for name-value pairs, which was incompatible with the 3.X series. It allows more precise filtering and sending data with proper type information to databases and document stores.

While syslog-ng PE is based on the open-source edition, its version numbering is completely independent of it.

syslog-ng provides a number of features in addition to transporting syslog messages and storing them in plain text log files:

• The ability to format log messages using Unix shell-like variable expansion (can break cross-platform log format compatibility)
• The use of this shell-like variable expansion when naming files, covering multiple destination files with a single statement
• The ability to send log messages to local applications
• Support for message flow-control in network transport
• Logging directly into a database (since syslog-ng OSE 2.1)
• Rewrite portions of the syslog message with set and substitute primitives (since syslog-ng OSE 3.0)
• Classify incoming log messages and at the same time extract structured information from the unstructured syslog message (since syslog-ng OSE 3.0)
• Generic name–value support: each message is just a set of name–value pairs, which can be used to store extra information (since syslog-ng OSE 3.0)
• The ability to process structured message formats transmitted over syslog, like extract columns from CSV formatted lines (since syslog-ng OSE 3.0)
• The ability to correlate multiple incoming messages to form a more complex, correlated event (since syslog-ng OSE 3.2);{{cite web|url=https://lwn.net/Articles/424459/| title=Correlating lo messages with syslog-ng| accessdate=2011-11-11}}

syslog-ng is available on a number of different Linux and Unix distributions. Some install it as the system default, or provide it as a package that replaces the previous standard syslogd. Several Linux distributions that used syslog-ng have replaced it with rsyslog.{{Citation needed|date=February 2021}}

• openSUSE used it as default prior to openSUSE 11.2, and is still available
• SLES used it prior to SUSE Linux Enterprise Server 12
• Debian GNU/Linux used syslogd and klogd prior to 5.0; post-5.0 ("Lenny"), rsyslog is used{{cite web |url=http://www.debian.org/releases/lenny/i386/release-notes/ch-whats-new.en.html#system-changes

| title=Chapter 2. What's new in Debian GNU/Linux 5.0

| accessdate=2010-05-22

}}

• Gentoo Linux
• Fedora used it prior to Fedora 10
• Arch Linux used it as default prior to the adoption of systemd in 2012
• Hewlett-Packard's HP-UX
• FreeBSD port
• A Cygwin port is available for Microsoft Windows

syslog-ng is highly portable to many Unix systems, old and new alike. A list of the currently known to work Unix versions are found below:

• Linux on i386, ARM, PowerPC, SPARC and x86-64 CPUs
• FreeBSD 7.x - 9.x on i386 and x86-64 CPUs
• AIX 5, 6 and 7 on IBM Power microprocessors
• HP-UX 11iv1, 11iv2 and 11iv3 on PA-RISC and Itanium CPUs
• Solaris 8, 9, 10 on SPARC, x86-64 and i386 CPUs
• Tru64 5.1b on Alpha CPUs

The list above is based on BalaBit's current first hand experience, other platforms may also work, but your mileage may vary.

• {{IETF RFC|3164|link=no}} – The BSD syslog protocol
• {{IETF RFC|5424|link=no}} – The Syslog Protocol
• {{IETF RFC|5425|link=no}} – Transport Layer Security (TLS) Transport Mapping for Syslog
• {{IETF RFC|5426|link=no}} – Transmission of Syslog Messages over UDP

{{Portal|Free and open-source software}}

• NXLog
• Datadog
• Syslog
• Rsyslog
• journald – incorporates syslog-functionality
• Graylog

Category:Logging software

Category:Free network-related software

Category:Internet protocols

Category:Internet Standards

Category:Linux security software

Category:Network management

Category:System administration