syslog-ng/syslog-ng
Freesyslog-ng is an enhanced log daemon, supporting a wide range of input and output methods: syslog, unstructured text, queueing, SQL & NoSQL.
About syslog-ng/syslog-ng
syslog-ng is an enhanced log daemon designed for high-performance log collection, processing, and forwarding. It supports a wide range of input and output methods including syslog (RFC3164 and RFC5424), JSON messages, unstructured text, message queues like AMQP, databases (SQL and NoSQL), and big data tools such as Elasticsearch, Apache Kafka, and Apache Hadoop. Built-in parsers (csv-parser, db-parser, kv-parser) allow classification and normalization of logs. syslog-ng can achieve performance comparable to a large cluster when running on a single node. Configuration examples show easy setup for system logs from /dev/log, network logs, and structured application logging with JSON output in key=value format.
Key Features
Pros & Cons
- Free and open source
- High performance, capable of handling large log volumes on a single node
- Supports a wide variety of input and output formats (syslog, JSON, databases, message queues, big data tools)
- Built-in log parsing and classification capabilities (csv-parser, db-parser, kv-parser)
- Active community with extensive documentation and quickstart guide
- Flexible configuration with SCL (syslog-ng configuration library)
- Configuration can be complex for beginners due to its own syntax
- Requires understanding of syslog-ng configuration language
- May need additional setup for big data integrations (Elasticsearch, Kafka, Hadoop)
- Limited graphical interface; primarily command-line configuration