rsyslog
rsyslog is an open-source log processing engine that collects, transforms, and routes event data.
What rsyslog is
rsyslog is an open-source log processing engine that collects, transforms, and routes event data. Its processing model connects inputs, rulesets, and actions to receive, filter, process, and output messages. The project says it can deliver over one million messages per second to local destinations when processing is limited. Reliability features include on-demand disk spooling, backup destinations, and multiple processing threads. Documented outputs include Elasticsearch and OpenSearch, Apache Kafka, HTTP endpoints, and syslog forwarding. Database outputs cover MariaDB/MySQL and PostgreSQL, with other databases supported through libdbi. It supports TLS-protected syslog and documents forwarding with peer authentication settings. Deployment options include source and Git installation, maintained packages for Ubuntu, RHEL/CentOS, and Debian, and a Docker container. The core programs are licensed under GPLv3, while some runtime files use LGPL. rsyslog is developed for POSIX, Linux, and related UNIX-like systems; it does not run natively on Windows. A separate Windows Agent collects Windows Event Logs and local log files and can relay syslog messages to rsyslog on Linux.
Good
- Processes logs through inputs, rulesets, and actions
- Routes outputs to Elasticsearch, Kafka, HTTP, and syslog
- Supports database outputs for MariaDB/MySQL and PostgreSQL
- Offers TLS-protected syslog and peer authentication settings
- Available as packages, source, Git installation, and Docker
Watch out
- Does not run natively on Windows
- Additional Unix variants such as AIX and HP-UX are upcoming
- Enterprise support starts at €1,999 a year
Who it suits
rsyslog suits teams collecting and routing logs in Linux or other POSIX environments. Windows users can collect event and local file logs with the separate Windows Agent and relay syslog messages to Linux.
Verdict
rsyslog provides a configurable pipeline for receiving, processing, and routing event data. Its core is aimed at Linux and POSIX systems; Windows collection is handled by a separate agent.
Plans and prices
From rsyslog's own pricing page, checked 9 Oct 2001.
| Plan | Price | What it gives you |
|---|---|---|
| rsyslog | Free | Open-source Linux/POSIX software · source, Git, and distribution packages · Free |
| Windows Agent Basic | $55, paid once | Per-machine license · Event Log Monitor · 0 remote text file monitor licenses · $55 per machine; page also shows €55 |
| Windows Agent Professional | $79, paid once | Per-machine license · Event Log and text file monitoring · 10 remote text file monitor licenses · $79 per machine; page also shows €79 |
| Windows Agent Enterprise | $109, paid once | Per-machine license · Event Log and text file monitoring · Unlimited remote text file monitor licenses · $109 per machine; page also shows €109 |
| Enterprise Support | €1,999 a year | 20 max support hours · 5 installations · 1 customer contact · 1–2 business day response · 1999 EURO for one year |
| Extended Enterprise Support | €3,899 a year | 40 max support hours · 5 installations · 2 customer contacts · 24 hour response on business days · 3899 EURO for one year |
| Unlimited Enterprise Support | €19,999 a year | 40 max support hours · Unlimited installations · 5 customer contacts · 24 hour response on business days · 19999 EURO for one year |
The facts
Each one read from rsyslog's own pages, with the date it was checked.
What it does
- Databases
- The feature list describes database outputs for MariaDB/MySQL and PostgreSQL, plus support through libdbi for several other databases.checked 9 Oct 2001
- Deployment
- The project offers source and Git installation paths, maintained packages for Ubuntu, RHEL/CentOS, and Debian, and a Docker container.checked 9 Oct 2001
- Integrations
- Documented outputs include Elasticsearch and OpenSearch, Apache Kafka, HTTP endpoints, and syslog forwarding.checked 9 Oct 2001
- Limit
- The feature list says support for additional Unix variants such as AIX and HP-UX is an upcoming item that needs volunteers.checked 9 Oct 2001
- Open source
- The project documentation says rsyslog core programs are released under GPLv3, while some runtime files are licensed under LGPL.checked 9 Oct 2001
- Pipeline
- Its processing model uses inputs, rulesets, and actions to receive, filter, process, and output messages.checked 9 Oct 2001
- Purpose
- rsyslog collects, transforms, and routes event data as a high-performance log processing engine.checked 9 Oct 2001
- Reliability
- Features include on-demand disk spooling, backup destinations, and multiple processing threads.checked 9 Oct 2001
- Scale
- The homepage says rsyslog can deliver over one million messages per second to local destinations when limited processing is applied.checked 9 Oct 2001
- Support
- Community support is available through the mailing list, while Adiscon offers paid enterprise support for business users.checked 9 Oct 2001
- Transport security
- rsyslog supports TLS-protected syslog and documents TLS forwarding with peer authentication settings.checked 9 Oct 2001
The company
- Founded
- 2004checked 28 Sep 2001
- Maker
- The rsyslog site is operated by Adiscon GmbH, which identifies itself as rsyslog’s main sponsor.checked 9 Oct 2001
Where it runs
- Platform scope
- The documentation says rsyslog does not run natively on Windows and is developed for POSIX, Linux, and related UNIX-like systems.checked 9 Oct 2001
- Windows collection
- The separate Windows Agent collects Windows Event Logs and local log files and can relay syslog messages to rsyslog on Linux.checked 9 Oct 2001
Alternatives to rsyslog
- 1
Telegraf
Free planOpen sourceWebAPILinuxmacOS8.2From $1,500 a month - 2
syslog-ng
Free planOpen sourceAPILinuxmacOSSelf-hosted8.0$2,800, paid once - 3
Honeycomb
Free planAndroidiOSWebAPI7.4From $150 a month - 4
Edge Delta
Free planWebAPILinuxmacOS7.0From $20 a month - 5
Bindplane
Free planWebAPILinuxSelf-hosted6.8From $499 a month - 6
NXLog
Free planWebWindowsmacOSLinux6.8From $12.12 a month