The syslog-ng application is not log analysis software. It can filter log messages and select only the ones matching certain criteria. It can even convert the messages and restructure them to a predefined format, or parse the messages and segment them into different fields. But syslog-ng cannot interpret and analyze the meaning behind the messages, or recognize patterns in the occurrence of different messages.
Log messages contain information about the events happening on the hosts. Monitoring system events is essential for security and system health monitoring reasons.
The original syslog protocol separates messages based on the priority of the message and the facility sending the message. These two parameters alone are often inadequate to consistently classify messages, as many applications might use the same facility, and the facility itself is not even included in the log message. To make things worse, many log messages contain unimportant information. The syslog-ng application helps you to select only the really interesting messages, and forward them to a central server.
Company policies or other regulations often require log messages to be archived. Storing the important messages in a central location greatly simplifies this process.
Version 3.19 of syslog-ng Open Source Edition includes the following main features.
The http() destination can now send log messages to the destination URLs in a load-balance fashion. This means that syslog-ng OSE sends each message to only one URL. For example, you can use this to send the messages to a set of ingestion nodes or indexers of your SIEM solution if a single node cannot handle the load. For details, see "Batch mode and load balancing" in the Administration Guide.
The syslog-ng OSE http() destination now automatically follows URL redirects (maximum 3), and can use the certificate store of the system (you can enable it using the use-system-cert-store() option).
Note that the flush-bytes(), flush-lines(), and flush-timeout() options have been renamed to batch-bytes(), batch-lines(), and batch-timeout(), respectively.
You can now directly send messages and alerts into Slack channels. For details, see "slack: Sending alerts and notifications to a Slack channel" in the Administration Guide.
The cisco-parser() now properly handles Cisco Catalyst formatted triplets.
The system() source now automatically handles RFC5424-formatted log messages, thus supporting FreeBSD 12.0.
When using TLS-encrypted communication, you can now compress the on-the-wire traffic using the allow-compress() option. Note that this option must be enabled both on the server and the client to have any effect. Enabling compression can significantly reduce the bandwidth required to transport the messages, but can slightly decrease the performance of syslog-ng OSE, reducing the number of transferred messages during a given period.
The network() and syslog() source drivers can bind to an interface instead of an IP address using the interface() option.
The network() and syslog() source drivers can reuse ports using the so-reuseport() option.
The syslog-ng application is used worldwide by companies and institutions who collect and manage the logs of several hosts, and want to store them in a centralized, organized way. Using syslog-ng is particularly advantageous for:
Internet Service Providers
Financial institutions and companies requiring policy compliance
Server, web, and application hosting companies
Datacenters
Wide area network (WAN) operators
Server farm administrators.
© 2025 One Identity LLC. ALL RIGHTS RESERVED. 使用条款 隐私 Cookie Preference Center
