From b6bcc14c0aa3f3b569abf630dc11ae9443ebca73 Mon Sep 17 00:00:00 2001 From: Rainer Gerhards Date: Wed, 30 Jan 2008 07:01:49 +0000 Subject: added rsyslog vs. syslog-ng comparison --- doc/rsyslog_ng_comparison.html | 241 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 241 insertions(+) create mode 100644 doc/rsyslog_ng_comparison.html (limited to 'doc/rsyslog_ng_comparison.html') diff --git a/doc/rsyslog_ng_comparison.html b/doc/rsyslog_ng_comparison.html new file mode 100644 index 00000000..db4bc729 --- /dev/null +++ b/doc/rsyslog_ng_comparison.html @@ -0,0 +1,241 @@ + + + + +rsyslog vs. syslog-ng - a comparison + + + + +

rsyslog vs. syslog-ng

+ +

Written by + + Rainer + + Gerhards (2008-01-29)

+ +

We have often been asked abut a comparison sheet between rsyslog and +syslog-ng. Unfortunately, I do not know much about syslog-ng, I did not even use +it once. Also, there seems to be no comprehensive feature sheet available for +syslog-ng. So I started this comparison, but it probably is not complete. For +sure, I miss some syslog-ng features. This is not an attempt to let rsyslog +shine more than it should. I just used the rsyslog feature sheet as a staring +point, simply because it was available. If you would like to add anything to the chart, or +correct it, please simply drop me a line. +I would love to see a real honest and up-to-date comparison sheet, so please +don't be shy ;)

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

Feature	rsyslog	syslog-ng
native support for + writing to MySQL + databases	yes	paid edition only
native support for writing to Postgres databases	yes	paid edition only
support for (plain) tcp based syslog	yes	yes
support for sending and receiving compressed syslog messages	yes	I think "no"
support for on-demand on-disk spooling of messages	yes	paid edition only
ability to configure backup syslog/database servers	yes	no
support for receiving messages via reliable + RFC + 3195 delivery	yes	no
ability to generate file names and directories (log targets) + dynamically	yes	yes
control of log output format, including ability to present channel + and priority as visible log data	yes	not sure...
good timestamp format control; at a minimum, ISO 8601/RFC 3339 + second-resolution UTC zone	yes	? (I guess so)
ability to reformat message contents and work with substrings	yes	I think yes
support for log files larger than 2gb	yes	yes
support for file size limitation and automatic rollover command + execution	yes	yes (?)
support for running multiple rsyslogd instances on a single machine	yes	? (but I think yes)
support for + ssl-protected + syslog	via stunnel	via stunnel + paid edition natively
ability to filter on any part of the message, not just facility and + severity	yes	yes
ability to use regular expressions in filters	yes	yes
support for discarding messages based on filters	yes	?
ability to execute shell scripts on received messages	yes	yes
ability to pipe messages to a continously running program	no	yes
ability to preserve the original hostname in NAT environments and + relay chains	yes	yes (think so)
ability to limit the allowed network senders (syslog ACLs)	yes	yes (?)
powerful BSD-style hostname and program name blocks for easy + multi-host support	yes	no
massively multi-threaded for tomorrow's multi-core machines	yes	?
support for IETF's new syslog-protocol draft	yes	no
support for syslog-transport-tls based framing on syslog/tcp + connections	yes	no (?)
support for IPv6	yes	yes (?)
ability to control repeated line reduction ("last message repeated n + times") on a per selector-line basis	yes	yes (?)
config file includes, also full directory includes	yes	?
supports multiple actions per selector/filter condition	yes	?
plug-in interface	yes	no (?)
Windows Event Log gatherer	via EventReporter or + MonitorWare Agent (both commercial + software)	via Windows agent, paid edition only
config file format	compatible to legacy syslogd but ugly	clean but not backwards compatible
support for GSS-API	yes	?
web interface	phpLogCon + [also works with + php-syslog-ng]	+ php-syslog-ng
? (probably many I do no know off...)	no	yes

This document is current as of 2008-01-29 and definitely incomplete (I did +not yet manage to complete it!).

+ + + + -- cgit