Syslog-ng

syslog-ng
Initial release 1998
Stable release
3.8.1[1] / August 19, 2016 (2016-08-19)
Operating system Unix-like
Type System logging
License GNU Lesser General Public License(core) GNU General Public License version 2(plugins)
Website http://www.balabit.com/network-security/syslog-ng/

syslog-ng is an open source implementation of the syslog protocol for Unix and Unix-like systems. It extends the original syslogd model with content-based filtering, rich filtering capabilities, flexible configuration options and adds important features to syslog, like using TCP for transport. As of today syslog-ng is developed by Balabit IT Security Ltd. It has two editions with a common codebase. The first is called syslog-ng Open Source Edition (OSE) with the license LGPL. The second is called Premium Edition (PE) and has additional plugins (modules) under proprietary license.

Protocol

syslog-ng uses the standard BSD syslog protocol, specified in RFC 3164. As the text of RFC 3164 is an informational description and not a standard, some incompatible extensions of it emerged. Since version 3.0 syslog-ng also supports the syslog protocol specified in RFC 5424. syslog-ng interoperates with a variety of devices, and the format of relayed messages can be customized.

Extensions to the original syslog-ng protocol include:

History

The syslog-ng project began in 1998, when Balázs Scheidler, the primary author of syslog-ng, ported the existing nsyslogd code to Linux. The 1.0.x branch of syslog-ng was still based on the nsyslogd sources and are available in the syslog-ng source archive.

Right after the release of syslog-ng 1.0.x, a reimplementation of the code base started to address some of the shortcomings of nsyslogd and to address the licensing concerns of Darren Reed, the original nsyslogd author. This reimplementation was named stable in the October 1999 with the release of version 1.2.0. This time around, syslog-ng depended on some code originally developed for lsh by Niels Möller.

Three major releases (1.2, 1.4 and 1.6) were using this code base, the last release of the 1.6.x branch in February 2007. In this period of about 8 years, syslog-ng became one of the popular alternative syslog implementations.

In a volunteer based effort, yet another rewrite was started back in 2001, dropping lsh code and using the more widely available GLib library. This rewrite of the codebase took its time, the first stable release of 2.0.0 happened in October 2006.

Development efforts were focused on improving the 2.0.x branch; support for 1.6.x was dropped at the end of 2007. Support for 2.x was dropped at the end of 2009, but it is still used in some Linux distributions.[3][4] Balabit, the company behind syslog-ng, started a parallel, commercial fork of syslog-ng, called syslog-ng Premium Edition. Portions of the commercial income are used to sponsor development of the free version.

Syslog-ng version 3.0 was released in the fourth quarter of 2008.

Starting with the 3.0 version developments efforts were parallel on the Premium and on the Open Source Editions. PE efforts were focused on quality, transport reliability, performance and encrypted log storage. The Open Source Edition efforts focused on improving the flexibility of the core infrastructure to allow more and more different, non-syslog message sources.

Both the OSE & PE forks produced two releases (3.1 and 3.2) in 2010.

Features

syslog-ng provides a number of features in addition to transporting syslog messages and storing them in plain text log files:

Distributions

syslog-ng is available on a number of different Linux and Unix distributions. Some install it as the system default, or provide it as a package that replaces the previous standard syslogd. Several Linux distributions that used syslog-ng have replaced it with rsyslog.

Portability

syslog-ng is highly portable to many Unix systems, old and new alike. A list of the currently known to work Unix versions are found below:

The list above is based on BalaBit's current first hand experience, other platforms may also work, but your mileage may vary.

See also

References

  1. ↑ https://github.com/balabit/syslog-ng/releases
  2. ↑ "Changelog 3.0.1". Retrieved 2009-01-21.
  3. ↑ "Debian syslog-ng package". Retrieved 2011-11-11.
  4. ↑ "SLES syslog-ng documentation" (PDF). Retrieved 2011-11-11.
  5. ↑ "Correlating lo messages with syslog-ng". Retrieved 2011-11-11.
  6. ↑ "Chapter 2. What's new in Debian GNU/Linux 5.0". Retrieved 2010-05-22.
  7. ↑ https://wiki.archlinux.org/index.php/Rsyslog
This article is issued from Wikipedia - version of the 8/21/2016. The text is available under the Creative Commons Attribution/Share Alike but additional terms may apply for the media files.