Skip to content
SPECIFICTION
Get listed

syslog-ng

syslog-ng.com

Free plan Open source WindowsmacOSLinuxAPISelf-hosted
Visit syslog-ng.com
Spec score 8.7 #2 of 28 in Telemetry Pipeline Software

What it is

syslog-ng collects infrastructure logs, processes them, and routes or stores them for analysis. Its free Open Source Edition can collect, parse, classify, rewrite, and correlate logs before sending them to analysis tools or storing them. Premium Edition adds filtering and real-time pattern correlation to reduce and normalize log data, plus disk buffering, client-side failover, and application-layer acknowledgements. It supports TLS-encrypted transfer and encrypted log storage with X.509 certificates for mutual authentication. Store Box offers access-controlled search and custom reports that can help with compliance work. Listed destinations include Elasticsearch, Hadoop, Kafka, MongoDB, SQL databases, Redis, Splunk, and SIEM tools. Premium licensing is based on Log Source Hosts, with annual support available; Store Box licensing depends on Log Source Hosts and hardware configuration. Open Source Edition is GPL/LGPL licensed and community supported. Commercial customers can access certified engineers and support services; Premium Edition and Store Box offer free trials.

Spec sheet

What it does
syslog-ng is an enhanced log daemon that receives syslog, unstructured text, message queues, SQL and NoSQL data and routes or stores it.Read 15 Oct 2026 · github.com
Purpose
syslog-ng collects logs from infrastructure sources, processes them, and routes or stores them for analysis.Read 5 Oct 2026 · syslog-ng.com
Free plan
YesRead 21 Sep 2026 · syslog-ng.com
Integrations
The product pages list destinations and integrations including Elasticsearch, Hadoop, Kafka, MongoDB, SQL databases, Redis, Splunk, and SIEM tools.Read 5 Oct 2026 · syslog-ng.com
Security
Premium Edition supports TLS-encrypted transfer and encrypted log storage, with X.509 certificates for host and server mutual authentication.Read 5 Oct 2026 · syslog-ng.com
Compliance
Commercial documentation describes logstore and reliable transfer features as helping with SOX, HIPAA and PCI-DSS collection requirements.Read 15 Oct 2026 · syslog-ng.github.io
Support
Commercial customers can access certified engineers, global coverage, and support services; Open Source Edition users are directed to community support and documentation.Read 5 Oct 2026 · syslog-ng.com
License
The public project combines LGPL and GPL licensing: core reusable code is generally LGPL 2.1-or-later while many modules are GPLv2-or-later.Read 15 Oct 2026 · github.com
Headquarters
Aliso Viejo, California, United StatesRead 28 Sep 2026 · syslog-ng.com
Analytics integrations
Native or documented outputs include Elasticsearch, HDFS, Hadoop, Graphite, Redis, Riemann, Google BigQuery, Google Pub/Sub, S3, Slack and Splunk HEC.Read 15 Oct 2026 · syslog-ng.github.io
Centralized logging
The Open Source Edition is documented as a flexible, scalable centralized logging system with parsing, filtering, rewriting, correlation and enrichment.Read 15 Oct 2026 · syslog-ng.github.io
Company incorporation
The UK One Identity legal entity was incorporated in 2016, according to Companies House.Read 15 Oct 2026 · find-and-update.company-information.service.gov.uk
Company legal name
Crunchbase lists the maker as One Identity LLC, a private company headquartered in Aliso Viejo, California, with 501–1,000 employees.Read 15 Oct 2026 · crunchbase.com
Company profile
LinkedIn lists One Identity as a privately held software-development company headquartered at 4 Polaris Way, Aliso Viejo, California, with 501–1,000 employees.Read 15 Oct 2026 · linkedin.com
Compliance reporting
Store Box provides access-controlled log search and custom reports that can help demonstrate compliance with PCI-DSS, ISO 27001, SOX, and HIPAA.Read 5 Oct 2026 · syslog-ng.com
Database integrations
Documented database destinations include MongoDB, Microsoft SQL Server, MySQL, Oracle, PostgreSQL and SQLite.Read 15 Oct 2026 · syslog-ng.github.io
Developer documentation
A separate developer guide covers plugin modules, source drivers, parsers, filters, template functions, Python destinations and Java destinations.Read 15 Oct 2026 · syslog-ng.github.io
Documentation depth
The documentation center contains searchable administration and developer guides, contribution instructions, mailing-list support and GitHub issue tracking.Read 15 Oct 2026 · syslog-ng.github.io
Encrypted storage
Premium Edition logstore files are encrypted, compressed, indexed and timestamped, with timestamping authorities supported.Read 15 Oct 2026 · syslog-ng.com
Installation
OSE can be installed from Debian/Ubuntu, RHEL, Fedora and Arch packages, official repositories, Docker images or source compilation.Read 15 Oct 2026 · syslog-ng.github.io
Limit: GUI and observability
PeerSpot reviewers request a graphical interface, stronger observability and improved filtering or integration breadth, and some say it is not a full SIEM.Read 15 Oct 2026 · peerspot.com
Limit: learning curve
Capterra reviewers say the configuration syntax takes time to learn, and one reviewer saw little extra functionality over basic operating-system syslog.Read 15 Oct 2026 · capterra.com
Log transformation
Premium Edition supports filtering, parsing, rewriting, classification, and real-time pattern correlation to reduce and normalize log data.Read 5 Oct 2026 · syslog-ng.com
Notable limits
Store Box can store up to 10 terabytes of uncompressed data on its largest appliance, according to the product page.Read 5 Oct 2026 · syslog-ng.com
Notable news: headquarters
ITPro reported on 26 June 2026 that One Identity planned independence from Quest and intended to designate its Cork, Ireland office as global headquarters.Read 15 Oct 2026 · itpro.com
Open source edition
Open Source Edition can collect, parse, classify, rewrite, and correlate logs, then store or route them to log analysis tools.Read 5 Oct 2026 · syslog-ng.com
Ownership history
The project README says Balabit, its original commercial sponsor, was acquired by One Identity in 2018, which offers Premium Edition.Read 15 Oct 2026 · github.com
Parsing
Built-in parsers include CSV, database and key-value parsers, with macros and rewrite capabilities for normalizing messages in flight.Read 15 Oct 2026 · github.com
Performance
The project reports 600,000–800,000 messages per second in a simple single-node use case, with lower throughput when parsing and filtering are enabled.Read 15 Oct 2026 · github.com
Platform support
Premium Edition installers are available for more than 50 server platforms, and its supported operating systems include Linux, BSD, Solaris, AIX, HP-UX, and Windows.Read 5 Oct 2026 · syslog-ng.com
Praise: configuration
PeerSpot reviewers repeatedly describe the C-style configuration as readable and syslog-ng as straightforward to install and maintain.Read 15 Oct 2026 · peerspot.com
Praise: performance and stability
PeerSpot reviewers praise high-volume processing, stability without crashes, TLS connections and deployments exceeding 400 hosts.Read 15 Oct 2026 · peerspot.com
Praise: support and compliance
Capterra reviewers praise commercial support for corporate compliance and secure centralized collection, routing and filtering.Read 15 Oct 2026 · capterra.com
Protocol support
Built-in sources and destinations support RFC3164, RFC5424, JSON, journald and arbitrary unstructured data over IPv4 and IPv6.Read 15 Oct 2026 · syslog-ng.github.io
Python extensibility
The developer documentation provides Python LogMessage and LogFetcher APIs plus custom Python source and destination classes.Read 15 Oct 2026 · syslog-ng.github.io
Queue integrations
Documented queue integrations include Kafka, AMQP and STOMP, while the project also supports file-based message queues.Read 15 Oct 2026 · syslog-ng.github.io
Rating on Capterra
4.3 out of 5 from 3 reviewsRead 15 Oct 2026 · capterra.com
Rating on FeaturedCustomers
4.8 out of 5 from 2,054 reference ratingsRead 15 Oct 2026 · featuredcustomers.com
Rating on PeerSpot
4.5 out of 5 from 7 reviewsRead 15 Oct 2026 · peerspot.com
Rating on SourceForge
No rating shown from 0 user reviewsRead 15 Oct 2026 · sourceforge.net
Reliability
Premium Edition uses disk buffering, client-side failover, and application-layer acknowledgement to help transfer logs without message loss.Read 5 Oct 2026 · syslog-ng.com
Reliable transfer
Premium Edition uses disk buffering, client failover, acknowledgements and its ALTP/RLTP protocols to resend messages after connection failures.Read 15 Oct 2026 · syslog-ng.com
REST API
The Store Box REST API can be called over HTTPS from languages including Java and Python to access log data.Read 15 Oct 2026 · syslog-ng.com
Scale
The Premium Edition page says one server can collect more than half a million log messages per second, depending on configuration.Read 5 Oct 2026 · syslog-ng.com
Store Box
Syslog-ng Store Box is a turnkey appliance with web search, reports, high availability, directory integrations and a REST API over HTTPS.Read 15 Oct 2026 · syslog-ng.com
Supported systems
Published packages cover Ubuntu 22.04–26.04, Debian 12–13 and RHEL 8–10 on x86-64 and ARM64; Docker images are also provided.Read 15 Oct 2026 · github.com
TLS security
TLS support provides encrypted transport, X.509 certificate authentication, mutual authentication, configurable cipher suites, CRLs, OCSP stapling and SNI.Read 15 Oct 2026 · syslog-ng.github.io
Trials
Free trial versions are offered for Premium Edition and Store Box, while Open Source Edition source code is available through GitHub.Read 5 Oct 2026 · syslog-ng.com

Plans and prices

syslog-ng Open Source Edition Free GPL/LGPL source · self-hosted · community support Read 15 Oct 2026 · syslog-ng.com
syslog-ng Premium Edition trial Free 30-day trial encrypted logstore · enrichment · zero-message-loss transfer · Hadoop/Elasticsearch destinations Read 15 Oct 2026 · syslog-ng.com
Syslog-ng Basic $2,800, paid once Per user, one time Capterra-listed entry plan Read 15 Oct 2026 · capterra.com
syslog-ng Premium Edition Priced on request Contact sales or partners commercial support · Windows and multi-platform binaries · enterprise features Read 15 Oct 2026 · syslog-ng.com
syslog-ng Premium Edition Marketplace Priced on request Contact me Microsoft Marketplace listing Read 15 Oct 2026 · marketplace.microsoft.com
syslog-ng Store Box Priced on request Licensing based on Log Source Hosts and hardware configuration · no license limits on amount or rate of data processed or stored Read 5 Oct 2026 · syslog-ng.com

Every syslog-ng plan and price →

Strong points and limits

Strong points

  • Open Source Edition is free and community supported
  • Routes logs to a range of listed destinations
  • Premium includes buffering and failover features
  • Store Box offers access-controlled log search
  • Free trials for Premium Edition and Store Box

Limits

  • Open Source Edition users rely on community support
  • Store Box appliance holds up to 10 TB uncompressed

Who it suits

The Open Source Edition suits teams seeking a free, self-hosted log collection and routing option. Premium Edition and Store Box are aimed at organizations needing additional transfer safeguards, search, reporting, or commercial support.

Verdict

syslog-ng spans free log collection and paid offerings with additional transfer, security, and reporting capabilities.

Where Specifiction places it

Alternatives to syslog-ngAll alternatives →