Compare syslog software
Likes 1
Compare syslog software: rsyslog vs syslog-ng
Compare syslog software: rsyslog vs syslog-ng
Link | rsyslog | syslog-ng |
|---|---|---|
| Aktualisieren | 2013-03-20 17:56:58 | 2013-03-20 17:56:58 |
| Webseite | rsyslog.com | balabit.com/... |
| license | GPLv3 (GPLv2 for v2 branch) | LGPL |
| Input Sources | ||
| UNIX domain socket | Ja | Ja |
| UDP | Ja | Ja |
| TCP | Ja | Ja |
| RELP | Ja | |
| RFC 3195/BEEP | Ja (via im3195) | Ja |
| kernel log | Ja | Ja |
| file | Ja | Ja |
| mark message generator as an optional input | Ja | |
| Standard output (stdout) of an application | Ja | |
| Named pipe | Ja | |
| Handle multi-line messages like Apache Tomcat or Oracle log messages | Nein | |
| Windows Event Log | Ja a Windows event logging software such as EventReporter orMonitorWare Agent (both commercial software, both fund rsyslogdevelopment) | - via separate agent only available at Personal Edition |
| Network (Protocol) Support | ||
| support for (plain) tcp based syslog | Ja | Ja |
| support for GSS-API | Ja | |
| ability to limit the allowed network senders (syslog ACLs) | Ja | |
| support for syslog-transport-tls based framing on syslog/tcp connections | Ja | |
| udp syslog | Ja | Ja |
| syslog over RELP | Ja | |
| truly reliable message delivery (Why is plain tcp syslog not reliable?) | Ja | |
| on the wire (zlib) message compression | Ja | - only when using TLS |
| support for receiving messages via reliable RFC 3195 delivery | Ja | |
| support for TLS/SSL-protected syslog | Ja (since 3.19.0)via stunnel | Ja |
| support for IETF's new syslog-protocol draft | Ja | Ja |
| support for IETF's new syslog-transport-tls draft | Ja (since 3.19.0 - world's first implementation) | Ja |
| support for IPv6 | Ja | Ja |
| native ability to send SNMP traps | Ja | - only in syslogng box appliance |
| ability to preserve the original hostname in NAT environments and relay chains | Ja | Ja |
| Message Filtering | ||
| Filtering for syslog facility and priority | Ja | Ja |
| Filtering for hostname | Ja | Ja |
| Filtering for application | Ja | Ja |
| Filtering for message contents | Ja | Ja |
| Filtering for sending IP address | Ja | Ja |
| ability to filter on any other message field not mentioned above (including substrings and the like) | Ja | Ja |
| support for complex filters, using full boolean algebra with and/or/not operators and parenthesis | Ja | Ja |
| Support for reusable filters: specify a filter once and use it in multiple selector lines no | Ja | |
| support for arbritrary complex arithmetic and string expressions inside filters | Ja | Ja |
| ability to use regular expressions in filters | Ja | Ja PRCE and POSIX |
| support for discarding messages based on filters | Ja | Ja |
| ability to filter out messages based on sequence of appearing | Ja (starting with 3.21.3) | |
| powerful BSD-style hostname and program name blocks for easy multi-host support | Ja | |
| Supported Database Outputs | ||
| MySQL | Ja (native ommysql, omlibdbi) | Ja |
| PostgreSQL | Ja (native ompgsql, omlibdbi) | Ja |
| Oracle | Ja (omlibdbi) | Ja |
| SQLite | Ja (omlibdbi) | Ja |
| Microsoft SQL (Open TDS) | Ja (omlibdbi) | Ja |
| Sybase (Open TDS) | Ja (omlibdbi) | |
| Firebird/Interbase | Ja (omlibdbi) | |
| Ingres | Ja (omlibdbi) | |
| mSQL | Ja (omlibdbi) | |
| Enterprise Features | ||
| support for on-demand on-disk spooling of messages | Ja | |
| ability to limit disk space used by spool files | Ja | |
| each action can use its own, independant set of spool files | Ja | |
| different sets of spool files can be placed on different disk | Ja | |
| ability to process spooled messages only during a configured timeframe (e.g. only during off-peak hours, during peak hours they are enqueued only) | Ja (can independently be configured for the main queue and each action queue) | |
| ability to configure backup syslog/database servers | Ja | |
| Professional Support | Ja | |
| Config File | ||
| config file format | compatible to legacy syslogd but ugly | |
| ability to include config file from within other config files | Ja | Ja |
| ability to include all config files existing in a specific directory | Ja | |
| Extensibility | ||
| Functionality split in separately loadable modules | Ja | |
| Support for third-party input plugins | Ja | |
| Support for third-party output plugins | Ja | |
| Other Features | ||
| ability to generate file names and directories (log targets) dynamically | Ja | Ja |
| control of log output format, including ability to present channel and priority as visible log data | Ja | Ja |
| native ability to send mail messages | Ja (ommail, introduced in 3.17.0) | |
| good timestamp format control; at a minimum, ISO 8601/RFC 3339 second-resolution UTC zone | Ja | Ja microsecond time resolution, extended RFC3339, timezone information |
| ability to reformat message contents and work with substrings | Ja | Ja |
| support for log files larger than 2gb | Ja | Ja |
| support for log file size limitation and automatic rollover command execution | Ja | Ja |
| support for running multiple syslogd instances on a single machine | Ja | |
| ability to execute shell scripts on received messages | Ja | |
| ability to pipe messages to a continously running program | ||
| massively multi-threaded for tomorrow's multi-core machines | Ja | Ja |
| ability to control repeated line reduction ("last message repeated n times") on a per selector-line basis | Ja | |
| supports multiple actions per selector/filter condition | Ja | |
| web interface | phpLogCon [also works with php-syslog-ng] | |
| using text files as input source | Ja | Ja |
| rate-limiting output actions | Ja | Ja |
| discard low-priority messages under system stress | Ja | |
| flow control (slow down message reception when system is busy) | Ja (advanced, multiple ways to slow down inputs depending on individual input capabilities, based on watermarks) | Ja |
| rewriting messages | Ja | Ja |
| output data into various formats | Ja | Ja |
| ability to control "message repeated n times" generation | Ja | |
| supported platforms Linux, BSD, anecdotical seen on Solaris; compilation and basic testing done on HP UX | Ja | |
| DNS cache | Ja | Ja |
| Windows Event Log containers / log files (via separate agent application) | ||
| Latest version | 7.2.6 stable (March 2013) | Open Source Edition (OSE) 3.4 (Feb 2013) |
User reviews and comments