computer science

Syslog-ng

Syslog-ng is a computer science topic covered in the lgStudy science library. This page brings together a partial reference excerpt, illustrations, worked examples, real-world applications and a short study plan, so you can understand Syslog-ng rather than just read about it. In short: syslog-ng is a free and open-source implementation of the syslog protocol for Unix and Unix-like systems. It extends the original syslogd model with content-based filtering, rich filtering capabilities, flexible configuration options and adds important features to syslog, like using TCP for transport.

Key takeaways

Syslog-ng belongs to computer science; place it in that map before memorising details.
Learn the definition first, then one example that makes the definition concrete.
Connect Syslog-ng to a quantity you can measure, compute or draw — that is where exam questions come from.
Reproduce the core statement of Syslog-ng from memory before moving on to harder problems.

Reference excerpt

syslog-ng is a free and open-source implementation of the syslog protocol for Unix and Unix-like systems. It extends the original syslogd model with content-based filtering, rich filtering capabilities, flexible configuration options and adds important features to syslog, like using TCP for transport. Syslog-ng is developed in the Budapest office of One Identity LLC. It has three editions with a common codebase. The first is called syslog-ng, also referred as syslog-ng Open Source Edition (OSE) with the license LGPL + GPLv2. The second is called syslog-ng Premium Edition (PE) and has additional plugins (modules) under a proprietary license. The third is called syslog-ng Storebox (SSB), which comes as an appliance with a Web-based UI as well as additional features including ultra-fast-text search, unified search, content-based alerting and a premier tier support. In January 2018, syslog-ng, as part of Balabit, was acquired by One Identity under the Quest Software umbrella. The syslog-ng team remains an independent business within the One Identity organization and continues under the syslog-ng brand. In May 2024, the original author of syslog-ng, Balázs Scheidler, forked syslog-ng and launched AxoSyslog, a fully open-source, drop in replacement that develops syslog-ng into a generic security data processor, integrating it with various cloud native tools and services.

Protocol syslog-ng supports a wide variety of protocols to receive or send log data. While its origins are in syslog, today it supports modern, cloud native transports such as OpenTelemetry (OTLP), Google PubSub or Kafka. syslog-ng interoperates with a variety of devices, and is capable of consuming and transforming data between various sources and destinations. Extensions to the original syslog-ng protocol include:

ISO 8601 timestamps with millisecond granularity and time zone information The addition of the name of relays in additional host fields, to make it possible to track the path of a given message Reliable transport using TCP TLS encryption (Since 3.0.1 in OSE )

History The syslog-ng project began in 1998, when Balázs Scheidler, the primary author of syslog-ng, ported the existing nsyslogd code to Linux. The 1.0.x branch of syslog-ng was still based on the nsyslogd sources and are available in the syslog-ng source archive. Right after the release of syslog-ng 1.0.x, a reimplementation of the code base started to address some of the shortcomings of syslog and to address the licensing concerns of Darren Reed, the original syslog author. This reimplementation was named stable in October 1999 with the release of version 1.2.0. This time around, syslog-ng depended on some code originally developed for lsh by Niels Möller. Three major releases (1.2, 1.4 and 1.6) were using this code base, the last release of the 1.6.x branch in February 2007. In this period of about 8 years, syslog-ng became one of the popular alternative syslog implementations. In a volunteer based effort, yet another rewrite was started back in 2001, dropping lsh code and using the more widely available GLib library. This rewrite of the codebase took its time, the first stable release of 2.0.0 happened in October 2006. Development efforts were focused on improving the 2.0.x branch. Support for 1.6.x was dropped at the end of 2007. Support for 2.x was dropped at the end of 2009, but it is still used in some Linux distributions. Balabit, the company behind syslog-ng, started a parallel, commercial fork of syslog-ng, called syslog-ng Premium Edition. Portions of the commercial income are used to sponsor development of the free version. Syslog-ng version 3.0 was released in the fourth quarter of 2008. Starting with the 3.0 version developments efforts were parallel on the Premium and on the Open Source Editions. PE efforts were focused on quality, transport reliability, performance and encrypted log storage. The Open Source Edition efforts focused on improving the flexibility of the core infrastructure to allow more and more different, non-syslog message sources. The syslog-ng 3.X series brought many major changes to syslog-ng without breaking backwards compatibility. Syslog-ng became modular and multi-threaded. Support for various document stores and message queuing systems was added. Many message types are now automatically parsed and turned into name-value-pairs. Extending syslog-ng using Java and Python became possible. Version 4.0 of syslog-ng was released in December, 2022. The main version number change was necessary due to a major change in type support for name-value pairs, which was incompatible with the 3.X series. It allows more precise filtering and sending data with proper type information to databases and document stores. While syslog-ng PE is based on the open-source edition, its version numbering is completely independent of it.

Features syslog-ng provides a number of features in addition to transporting syslog messages and storing them in plain text log files:

The ability to format log messages using Unix shell-like variable expansion (can break cross-platform log format compatibility) The use of this shell-like variable expansion when naming files, covering multiple destination files with a single statement The ability to send log messages to local applications Support for message flow-control in network transport Logging directly into a database (since syslog-ng OSE 2.1) Rewrite portions of the syslog message with set and substitute primitives (since syslog-ng OSE 3.0) Classify incoming log messages and at the same time extract structured information from the unstructured syslog message (since syslog-ng OSE 3.0) Generic name–value support: each message is just a set of name–value pairs, which can be used to store extra information (since syslog-ng OSE 3.0) The ability to process structured message formats transmitted over syslog, like extract columns from CSV formatted lines (since syslog-ng OSE 3.0) The ability to correlate multiple incoming messages to form a more complex, correlated event (since syslog-ng OSE 3.2);

Distributions syslog-ng is available on a number of different Linux and Unix distributions. Some install it as the system default, or provide it as a package that replaces the previous standard syslogd. Several Linux distributions that used syslog-ng have replaced it with rsyslog.

… excerpt ends here. Continue reading the full article.

Worked examples

Example 1 — a first encounter with Syslog-ng

Start with the simplest possible case. Write down what Syslog-ng claims or describes in one sentence, then invent the smallest concrete situation in which that sentence is true. In computer science, the smallest case is usually a single object, a single equation or a single measurement. Check that every symbol or term in your sentence has a meaning in that case.

Example 2 — changing one variable

Take the situation from Example 1 and change exactly one quantity: double it, halve it, or set it to zero. Predict what should happen to Syslog-ng before you calculate. Comparing your prediction with the result is the fastest way to find out whether you understand the idea or only the words.

Example 3 — an exam-style question

Typical questions about Syslog-ng ask you to (a) state it precisely, (b) apply it to given data, and (c) explain a limitation. Practise writing all three answers in under five minutes; the third part is what separates a full-mark answer from an average one.

Applications of Syslog-ng

In research: Syslog-ng appears in computer science research whenever the underlying quantities have to be modelled precisely. Papers usually cite it as a starting assumption and then explore where it breaks down.
In technology and industry: Engineering practice reuses Syslog-ng in design rules, simulations and safety margins. Knowing the idea lets you read a specification sheet and understand why the numbers look the way they do.
In the classroom: Syslog-ng is common in secondary-school and first-year university syllabi. It links to neighbouring topics Free network-related software, Internet Standards, Internet protocols, so understanding it makes those chapters shorter.
In everyday life: Look for Syslog-ng outside the textbook — in sport, cooking, traffic, electronics or the sky above you. An example you found yourself is remembered far longer than one you were given.

Affiliate

Preply — study more efficiently by working with a personal tutor. 50% off.

How to study Syslog-ng in 20 minutes

Read the reference excerpt below once, without taking notes.
Close the page and write down what Syslog-ng means in your own words.
Compare your version with the excerpt and mark what you missed.
Work through the three examples above with pen and paper.
Explain Syslog-ng out loud to somebody else — or to Teacher Smith in the lgStudy chat.

Frequently asked questions

What is Syslog-ng in simple terms?

Why does Syslog-ng matter?

Because it connects several computer science ideas at once: it gives you a definition you can apply, a quantity you can calculate, and a way to check whether a result is plausible.

How should I study Syslog-ng?

Read the excerpt, restate it from memory, then work through the examples and applications listed on this page. The five-step study plan above takes about twenty minutes.

What does this page cover?

It gives you a compact reference excerpt plus original lgStudy explanations, examples, applications and study material on Syslog-ng.