4 ms·

What Is a Syslog Server?

QuinnyPig 2mo ago
"Splunk that runs locally with a worse UX, but on balance doesn't eat all the resources you throw at it and doesn't charge you a kidney."
- brianjlogan 2mo ago
  There's far cheaper alternatives to Splunk that are still a step up from traditional syslog. KubeCon over the last couple of years was showing the market was a glut with Observability vendors which is just time series and log management. (traces are logs with a span id).
IronWolve 2mo ago
We moved to splunk now and mostly happy with it, mix of windows/linux/etc logs. But with AI, I can see opensource alternatives getting better.
- unethical_ban 2mo ago
  I've never been in the sales room. I've heard from multiple corps that Splunk is quite expensive. I've been to one place that ran its own Elastic stack, which was a bit of cost in its own right because they had to run all the infrastructure and storage themselves, and had two FTEs whose main job was keeping the thing running. I don't know what Splunk offers from a UI/features perspective that Kibana couldn't do.
  - Avicebron 2mo ago
    I agree (as the owner of an elastic stack at work). A second FTE sounds like a luxury though..
    - winrid 2mo ago
      That's indeed pretty rare IME :)
brianjlogan 2mo ago
> A syslog server is a foundational tool for centralized log management in modern IT environments I'd very much recommend a more modern log stack than a traditional syslog server. There are many articles covering the limitations of Syslog. Better to replace that component by utilities like OpenTelemetry and JSON structured logging. You can run a single binary version of Loki https://grafana.com/docs/loki/latest/get-started/deployment-modes/ https://grafana.com/docs/loki/latest/get-started/deployment-... Or use something like the Otel collector to send your logs to a remote host. I have done my fair share of rsyslog and syslog-ng. I would not say a "Syslog" server belongs in a modern stack.
- skullone 2mo ago
  I disagree. I work in a large environment, and rsyslog is where 90% of data goes to first. It can keep up with millions of messages per second, route them to higher order services for indexing (bigquery, splunk, elastic etc etc). Has rules engines, encryption, supports multiple protocols and obviously has TLS too. You can surely augment with otel and such where you can, but syslog is uhhhh, deployed in so many places that it would make an average app developer's head spin when all they're used to is application logging in a controlled structured place in their silo.
  - shmoe 2mo ago
    Even SC4S, splunk's docker appliance for turnkey syslog uses rsyslogd. Edit: being pedantic -- it's syslog-ng actually.
    - skullone 2mo ago
      And the number of k8s envs that log stdout through them into.... more rsyslog, it's truly everywhere. Plus all the sidecar containers deployed that shuffle app logs, lots of syslog there, its so lightweight and simple and reliable. I watch all the gyrations people go through to achieve the same result, and it's always changing, hurts my brain thinking how much time they waste
  - otterley 2mo ago
deleted 2mo ago
[deleted]
ang_cire 2mo ago
An intro article on syslog servers in the year of our Lord 2026? Did you know you can replace your noSQL db with VSAM too (honestly better than mongo).
- nailer 2mo ago
  Mongo stopped having major data loss issues after a decade - my understanding is it's pretty stable now. You might hate the company for beta testing on your data but that's a separate issue.
  - ang_cire 2mo ago
    I was mostly just being cheeky :P I don't have anything against mongo in particular, the real nosql problem imo is people overusing it.
- sophacles 2mo ago
  I'd reckon that even in this modern age there are on the order of 10^9 people who don't know what a syslog server is.
- redundantly 2mo ago
  https://xkcd.com/1053/ https://xkcd.com/1053/
_kb 2mo ago
Syslog is still everywhere on a lot of hardware and appliance style devices. For those bringing that into modern telemetry stack I can't recommend Grafana Alloy enough (https://grafana.com/docs/alloy/latest/ https://grafana.com/docs/alloy/latest/). There's a loki.source.syslog component that lets you ingest RFC5424 or RFC3164 format messages over UDP, TCP, and with mTLS. These can then be parsed, filtered, transformed, and routed to anywhere else you require. If you're stuck with a device that's UDP only it can deploy to a nearby host (e.g. container runtime on a switch, or local ingest node), perform log collection, then queue and forward via OTel to central or cloud infra with encryption, delivery and integrity guarantees from there. It's a really neat and powerful tool.
Transformanshen 2mo ago
The article is not bad, but a little outdated. Syslog is a database that will not go anywhere, because a lot of equipment and software still send logs this way. But in 2026, building the entire infrastructure around it is already strange.
- smw 2mo ago
  Database?

"Splunk that runs locally with a worse UX, but on balance doesn't eat all the resources you throw at it and doesn't charge you a kidney."

brianjlogan 2mo ago
There's far cheaper alternatives to Splunk that are still a step up from traditional syslog. KubeCon over the last couple of years was showing the market was a glut with Observability vendors which is just time series and log management. (traces are logs with a span id).

IronWolve 2mo ago

We moved to splunk now and mostly happy with it, mix of windows/linux/etc logs. But with AI, I can see opensource alternatives getting better.

unethical_ban 2mo ago
I've never been in the sales room. I've heard from multiple corps that Splunk is quite expensive. I've been to one place that ran its own Elastic stack, which was a bit of cost in its own right because they had to run all the infrastructure and storage themselves, and had two FTEs whose main job was keeping the thing running. I don't know what Splunk offers from a UI/features perspective that Kibana couldn't do.
- Avicebron 2mo ago
  I agree (as the owner of an elastic stack at work). A second FTE sounds like a luxury though..
  - winrid 2mo ago
    That's indeed pretty rare IME :)

brianjlogan 2mo ago

> A syslog server is a foundational tool for centralized log management in modern IT environments I'd very much recommend a more modern log stack than a traditional syslog server. There are many articles covering the limitations of Syslog. Better to replace that component by utilities like OpenTelemetry and JSON structured logging. You can run a single binary version of Loki https://grafana.com/docs/loki/latest/get-started/deployment-modes/ https://grafana.com/docs/loki/latest/get-started/deployment-... Or use something like the Otel collector to send your logs to a remote host. I have done my fair share of rsyslog and syslog-ng. I would not say a "Syslog" server belongs in a modern stack.

skullone 2mo ago
I disagree. I work in a large environment, and rsyslog is where 90% of data goes to first. It can keep up with millions of messages per second, route them to higher order services for indexing (bigquery, splunk, elastic etc etc). Has rules engines, encryption, supports multiple protocols and obviously has TLS too. You can surely augment with otel and such where you can, but syslog is uhhhh, deployed in so many places that it would make an average app developer's head spin when all they're used to is application logging in a controlled structured place in their silo.
- shmoe 2mo ago
  Even SC4S, splunk's docker appliance for turnkey syslog uses rsyslogd. Edit: being pedantic -- it's syslog-ng actually.
  - skullone 2mo ago
    And the number of k8s envs that log stdout through them into.... more rsyslog, it's truly everywhere. Plus all the sidecar containers deployed that shuffle app logs, lots of syslog there, its so lightweight and simple and reliable. I watch all the gyrations people go through to achieve the same result, and it's always changing, hurts my brain thinking how much time they waste
- otterley 2mo ago

deleted 2mo ago

[deleted]

ang_cire 2mo ago

An intro article on syslog servers in the year of our Lord 2026? Did you know you can replace your noSQL db with VSAM too (honestly better than mongo).

nailer 2mo ago
Mongo stopped having major data loss issues after a decade - my understanding is it's pretty stable now. You might hate the company for beta testing on your data but that's a separate issue.
- ang_cire 2mo ago
  I was mostly just being cheeky :P I don't have anything against mongo in particular, the real nosql problem imo is people overusing it.
sophacles 2mo ago
I'd reckon that even in this modern age there are on the order of 10^9 people who don't know what a syslog server is.
redundantly 2mo ago
https://xkcd.com/1053/ https://xkcd.com/1053/

_kb 2mo ago

Syslog is still everywhere on a lot of hardware and appliance style devices. For those bringing that into modern telemetry stack I can't recommend Grafana Alloy enough (https://grafana.com/docs/alloy/latest/ https://grafana.com/docs/alloy/latest/). There's a loki.source.syslog component that lets you ingest RFC5424 or RFC3164 format messages over UDP, TCP, and with mTLS. These can then be parsed, filtered, transformed, and routed to anywhere else you require. If you're stuck with a device that's UDP only it can deploy to a nearby host (e.g. container runtime on a switch, or local ingest node), perform log collection, then queue and forward via OTel to central or cloud infra with encryption, delivery and integrity guarantees from there. It's a really neat and powerful tool.

Transformanshen 2mo ago

The article is not bad, but a little outdated. Syslog is a database that will not go anywhere, because a lot of equipment and software still send logs this way. But in 2026, building the entire infrastructure around it is already strange.

smw 2mo ago
Database?