Written by Rainer Gerhards (2008-01-29)
We have often been asked abut a comparison sheet between rsyslog and syslog-ng. Unfortunately, I do not know much about syslog-ng, I did not even use it once. Also, there seems to be no comprehensive feature sheet available for syslog-ng. So I started this comparison, but it probably is not complete. For sure, I miss some syslog-ng features. This is not an attempt to let rsyslog shine more than it should. I just used the rsyslog feature sheet as a staring point, simply because it was available. If you would like to add anything to the chart, or correct it, please simply drop me a line. I would love to see a real honest and up-to-date comparison sheet, so please don't be shy ;)
Feature | rsyslog | syslog-ng |
native support for writing to MySQL databases | yes | paid edition only |
native support for writing to Postgres databases | yes | paid edition only |
support for (plain) tcp based syslog | yes | yes |
support for sending and receiving compressed syslog messages | yes | I think "no" |
support for on-demand on-disk spooling of messages | yes | paid edition only |
ability to configure backup syslog/database servers | yes | no |
support for receiving messages via reliable RFC 3195 delivery | yes | no |
ability to generate file names and directories (log targets) dynamically | yes | yes |
control of log output format, including ability to present channel and priority as visible log data | yes | not sure... |
good timestamp format control; at a minimum, ISO 8601/RFC 3339 second-resolution UTC zone | yes | ? (I guess so) |
ability to reformat message contents and work with substrings | yes | I think yes |
support for log files larger than 2gb | yes | yes |
support for file size limitation and automatic rollover command execution | yes | yes (?) |
support for running multiple rsyslogd instances on a single machine | yes | ? (but I think yes) |
support for ssl-protected syslog | via stunnel | via stunnel paid edition natively |
ability to filter on any part of the message, not just facility and severity | yes | yes |
ability to use regular expressions in filters | yes | yes |
support for discarding messages based on filters | yes | ? |
ability to execute shell scripts on received messages | yes | yes |
ability to pipe messages to a continously running program | no | yes |
ability to preserve the original hostname in NAT environments and relay chains | yes | yes (think so) |
ability to limit the allowed network senders (syslog ACLs) | yes | yes (?) |
powerful BSD-style hostname and program name blocks for easy multi-host support | yes | no |
massively multi-threaded for tomorrow's multi-core machines | yes | ? |
support for IETF's new syslog-protocol draft | yes | no |
support for syslog-transport-tls based framing on syslog/tcp connections | yes | no (?) |
support for IPv6 | yes | yes (?) |
ability to control repeated line reduction ("last message repeated n times") on a per selector-line basis | yes | yes (?) |
config file includes, also full directory includes | yes | ? |
supports multiple actions per selector/filter condition | yes | ? |
plug-in interface | yes | no (?) |
Windows Event Log gatherer | via EventReporter or MonitorWare Agent (both commercial software) | via Windows agent, paid edition only |
config file format | compatible to legacy syslogd but ugly | clean but not backwards compatible |
support for GSS-API | yes | ? |
web interface | phpLogCon [also works with php-syslog-ng] |
php-syslog-ng |
? (probably many I do no know off...) | no | yes |
This document is current as of 2008-01-29 and definitely incomplete (I did not yet manage to complete it!).