RSyslog - Features

This page lists both current features as well as those being considered for future versions of rsyslog. If you think a feature is missing, drop Rainer a note. Rsyslog is a vital project. Features are added each few days. If you would like to keep up of what is going on, you can also subscribe to the rsyslog mailing list.

Current Features

• native support for writing to MySQL databases
• support for (plain) tcp based syslog - much better reliability
• control of log output format, including ability to present channel and priority as visible log data
• good timestamp format control; at a minimum, ISO 8601/RFC 3339 second-resolution UTC zone
• ability to reformat message contents and work with substrings
• support for log files larger than 2gb
• support for file size limitation and automatic rollover command execution
• support for running multiple rsyslogd instances on a single machine
• support for ssl-protected syslog (via stunnel)
• ability to filter on any part of the message, not just facility and severity
• support for discarding messages based on filters
• ability to execute shell scripts on received messages
• control of whether the local hostname or the hostname of the origin of the data is shown as the hostname in the output
• ability to preserve the orginal hostname in NAT environments and relay chains

Upcoming Features

• support for syslog-protocol-14 compliant messages (pending, as IETF will change proposed format)
• support for native SSL enryption of plain tcp syslog sessions
• RFC 3195 support - planned (but late)
• pcre filtering - maybe (depending on feedback)  - simple regex already partly added
• ability to limit the allowed network senders
• multi-threaded redesign - maybe (depending on feedback; also opens Pandorra's cross-platform development box ;))

To see when each feature was added, see the rsyslog change log (online only).