syslog-ng

Gitter Build Status Binary packages Compile dbld-images

syslog-ng

syslog-ng is an enhanced log daemon, supporting a wide range of input and output methods: syslog, unstructured text, message queues, databases (SQL and NoSQL alike), and more.

Quickstart

The simplest configuration accepts system logs from /dev/log (from applications or forwarded by systemd) and writes everything to a single file:

@version: 3.35
@include "scl.conf"

log {
	source { system(); };
	destination { file("/var/log/syslog"); };
};

This one additionally processes logs from the network (TCP/514 by default):

@version: 3.35
@include "scl.conf"

log {
	source {
		system();
		network();
	};
	destination { file("/var/log/syslog"); };
};

This config is designed for structured/application logging, using local submission via JSON, and outputting in key=value format:

@version: 3.35
@include "scl.conf"

log {
	source { system(); };
	destination { file("/var/log/app.log" template("$(format-welf --subkeys .cim.)\n")); };
};

To submit a structured log using logger, you might run:

$ logger '@cim: {"name1":"value1", "name2":"value2"}'

In which case the resulting message will be:

name1=value1 name2=value2

For a brief introduction to configuring the syslog-ng application, see the quickstart guide.

Features

Performance

Community

Sponsors

Balabit is the original creator and largest current sponsor of the syslog-ng project. They offer support, professional services, and addons you may be interested in

Feedback

We are really interested to see who uses our software, so if you do use it and you like what you see, please tell us about it. A star on github or an email saying thanks means a lot already, but telling us about your use case, your experience, and things to improve would be much appreciated.

Just send an email to feedback (at) syslog-ng.org.

Feedback Powers Open Source.

Installation from source

Releases and precompiled tarballs are available on GitHub.

To compile from source, the easiest is to use dbld, a docker based, self-hosted compile/build/release infrastructure within the source tree. See dbld/README.md for more information.

For the brave souls who want to compile syslog-ng from scratch, the usual drill applies:

$ ./configure && make && make install

The extra effort in contrast with the dbld based build is the need to fetch and install all build dependencies of syslog-ng (of which there are a few).

If you don’t have a configure script (because of cloning from git, for example), run ./autogen.sh to generate it.

Some of the functionality of syslog-ng is compiled only if the required development libraries are present. The configure script displays a summary of enabled features at the end of its run. For details, see the syslog-ng compiling instructions.

Installation from binaries

Binaries are available in various Linux distributions and contributors maintain packages of the latest and greatest syslog-ng version for various OSes.

Debian/Ubuntu

Simply invoke the following command as root:

# apt-get install syslog-ng

The latest versions of syslog-ng are available for a wide range of Debian and Ubuntu releases from our APT repository.

The packages and the APT repository are provided “as is” without warranty of any kind, on a best-effort level.

Installation steps:

  1. Download and install the release signing key:

     wget -qO - https://ose-repo.syslog-ng.com/apt/syslog-ng-ose-pub.asc | sudo apt-key add -

  2. Add the repository containing the latest stable build of syslog-ng to the APT sources. For example, on Ubuntu 20.04:

     echo "deb https://ose-repo.syslog-ng.com/apt/ stable ubuntu-focal" | sudo tee -a /etc/apt/sources.list.d/syslog-ng-ose.list

  3. Run apt-get update

syslog-ng packages are released for the following distribution versions (x86-64):

Distro version sources.list component name
Ubuntu 21.10 ubuntu-impish
Ubuntu 20.04 ubuntu-focal
Ubuntu 18.04 ubuntu-bionic
Ubuntu 16.04 ubuntu-xenial
Debian 11 debian-bullseye
Debian 10 debian-buster
Debian 9 debian-stretch
Debian Unstable debian-sid
Debian Testing debian-testing

Fedora

syslog-ng is available as a Fedora package that you can install using yum:

# yum install syslog-ng

You can download packages for the latest versions from here.

For instructions on how to install syslog-ng on RPM distributions, see the blog post Installing latest syslog-ng on RHEL and other RPM distributions.

If you wish to install the latest RPM package that comes from a recent commit in Git for testing purposes, read the blog post, RPM packages from syslog-ng Git HEAD.

Others

Binaries for other platforms are listed on the official third party page.

Installation from Docker image

Binaries are also available as a Docker image. To find out more, check out the blog post, Your central log server in Docker.

Documentation

The documentation of the latest released version of syslog-ng Open Source Edition is available here. For earlier versions, see the syslog-ng Documentation Page.

Contributing

If you would like to contribute to syslog-ng, to fix a bug or create a new module, the syslog-ng gitbook helps you take the first steps to working with the code base.

Log4j

The syslog-ng Open Source Edition does not use the affected versions of Apache Log4j, therefore it is not impacted by CVE-2021-44228, CVE-2021-4104, CVE-2021-45015. #3876

This site is open source. Improve this page.