Business > IT development
2013-03-20 17:56:58
Compare syslog software
Last update2013-03-20 17:56:58
licenseGPLv3 (GPLv2 for v2 branch)
Input Sources
UNIX domain socketYes
RFC 3195/BEEPYes (via im3195)
kernel logYes
mark message generator as an optional inputYes
Standard output (stdout) of an application
Named pipe
Handle multi-line messages like Apache Tomcat or Oracle log messages
Windows Event LogYes a Windows event logging software such as EventReporter orMonitorWare Agent (both commercial software, both fund rsyslogdevelopment)
Network (Protocol) Support
support for (plain) tcp based syslogYes
support for GSS-APIYes
ability to limit the allowed network senders (syslog ACLs)Yes
support for syslog-transport-tls based framing on syslog/tcp connectionsYes
udp syslogYes
syslog over RELPYes
truly reliable message delivery (Why is plain tcp syslog not reliable?)Yes
on the wire (zlib) message compressionYes
support for receiving messages via reliable RFC 3195 deliveryYes
support for TLS/SSL-protected syslogYes (since 3.19.0)via stunnel
support for IETF's new syslog-protocol draftYes
support for IETF's new syslog-transport-tls draftYes (since 3.19.0 - world's first implementation)
support for IPv6Yes
native ability to send SNMP trapsYes
ability to preserve the original hostname in NAT environments and relay chainsYes
Message Filtering
Filtering for syslog facility and priorityYes
Filtering for hostnameYes
Filtering for applicationYes
Filtering for message contentsYes
Filtering for sending IP addressYes
ability to filter on any other message field not mentioned above (including substrings and the like)Yes
support for complex filters, using full boolean algebra with and/or/not operators and parenthesisYes
Support for reusable filters: specify a filter once and use it in multiple selector lines no
support for arbritrary complex arithmetic and string expressions inside filtersYes
ability to use regular expressions in filtersYes
support for discarding messages based on filtersYes
ability to filter out messages based on sequence of appearingYes (starting with 3.21.3)
powerful BSD-style hostname and program name blocks for easy multi-host supportYes
Supported Database Outputs
MySQLYes (native ommysql, omlibdbi)
PostgreSQLYes (native ompgsql, omlibdbi)
OracleYes (omlibdbi)
SQLiteYes (omlibdbi)
Microsoft SQL (Open TDS)Yes (omlibdbi)
Sybase (Open TDS)Yes (omlibdbi)
Firebird/InterbaseYes (omlibdbi)
IngresYes (omlibdbi)
mSQLYes (omlibdbi)
Enterprise Features
support for on-demand on-disk spooling of messagesYes
ability to limit disk space used by spool filesYes
each action can use its own, independant set of spool filesYes
different sets of spool files can be placed on different diskYes
ability to process spooled messages only during a configured timeframe (e.g. only during off-peak hours, during peak hours they are enqueued only)Yes (can independently be configured for the main queue and each action queue)
ability to configure backup syslog/database serversYes
Professional SupportYes
Config File
config file formatcompatible to legacy syslogd but ugly
ability to include config file from within other config filesYes
ability to include all config files existing in a specific directoryYes
Functionality split in separately loadable modulesYes
Support for third-party input pluginsYes
Support for third-party output pluginsYes
Other Features
ability to generate file names and directories (log targets) dynamicallyYes
control of log output format, including ability to present channel and priority as visible log dataYes
native ability to send mail messagesYes (ommail, introduced in 3.17.0)
good timestamp format control; at a minimum, ISO 8601/RFC 3339 second-resolution UTC zoneYes
ability to reformat message contents and work with substringsYes
support for log files larger than 2gbYes
support for log file size limitation and automatic rollover command executionYes
support for running multiple syslogd instances on a single machineYes
ability to execute shell scripts on received messagesYes
ability to pipe messages to a continously running program
massively multi-threaded for tomorrow's multi-core machinesYes
ability to control repeated line reduction ("last message repeated n times") on a per selector-line basisYes
supports multiple actions per selector/filter conditionYes
web interfacephpLogCon [also works with php-syslog-ng]
using text files as input sourceYes
rate-limiting output actionsYes
discard low-priority messages under system stressYes
flow control (slow down message reception when system is busy)Yes (advanced, multiple ways to slow down inputs depending on individual input capabilities, based on watermarks)
rewriting messagesYes
output data into various formatsYes
ability to control "message repeated n times" generationYes
supported platforms Linux, BSD, anecdotical seen on Solaris; compilation and basic testing done on HP UX
DNS cacheYes
Windows Event Log containers / log files (via separate agent application)
Latest version7.2.6 stable (March 2013)
  • 2013-03-19 19:13:35
    2013-03-20 17:56:58
  • IT development
  • Public
  • Creative Commons License CC-BY-SA 3.0 / GNU FDL


No comments yet. Be the first to give your opinion.

Leave a comment

Register Sign in