rsyslog vs syslog-ng
rsyslog
rsyslog.comsyslog-ng
syslog-ng.comSide by side
| Figure | rsyslog | syslog-ng |
|---|---|---|
| Price from | €166.58/mo | Free |
| Free plan | Yes | Yes |
| Free trial | — | Yes |
| Open source | — | Yes |
| Windows | Yes | Yes |
| macOS | — | Yes |
| Linux | Yes | Yes |
| API | — | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 7 | 6 |
| Spec score · Telemetry Pipeline Software | 7.9 (#16) | 8.7 (#2) |
| Integrations | Documented outputs include Elasticsearch and OpenSearch, Apache Kafka, HTTP endpoints, and syslog forwarding. | The product pages list destinations and integrations including Elasticsearch, Hadoop, Kafka, MongoDB, SQL databases, Redis, Splunk, and SIEM tools. |
| Purpose | rsyslog collects, transforms, and routes event data as a high-performance log processing engine. | syslog-ng collects logs from infrastructure sources, processes them, and routes or stores them for analysis. |
| Reliability | Features include on-demand disk spooling, backup destinations, and multiple processing threads. | Premium Edition uses disk buffering, client-side failover, and application-layer acknowledgement to help transfer logs without message loss. |
| Scale | The homepage says rsyslog can deliver over one million messages per second to local destinations when limited processing is applied. | The Premium Edition page says one server can collect more than half a million log messages per second, depending on configuration. |
| Support | Community support is available through the mailing list, while Adiscon offers paid enterprise support for business users. | Commercial customers can access certified engineers, global coverage, and support services; Open Source Edition users are directed to community support and documentation. |
Plans
rsyslog
- rsyslogFree
- Windows Agent Basic$55, paid once
- Windows Agent Professional$79, paid once
- Windows Agent Enterprise$109, paid once
- Enterprise Support€1,999 a year
- Extended Enterprise Support€3,899 a year
- Unlimited Enterprise Support€19,999 a year
syslog-ng
- syslog-ng Open Source EditionFree
- syslog-ng Premium Edition trialFree
- Syslog-ng Basic$2,800, paid once
- syslog-ng Premium EditionPriced on request
- syslog-ng Premium Edition MarketplacePriced on request
- syslog-ng Store BoxPriced on request
In their own words
rsyslog
rsyslog is a self-hosted engine for collecting, transforming and routing event data, with a processing model built from inputs, rulesets and actions. The project says it can deliver over one million messages per second to local destinations when processing is limited. Reliability features include on-demand disk spooling, backup destinations and multiple processing threads. Documented outputs include Elasticsearch, OpenSearch, Apache Kafka, HTTP endpoints and syslog forwarding. Database outputs cover MariaDB/MySQL and PostgreSQL, with libdbi support for other databases. TLS-protected syslog and forwarding with peer authentication settings are documented. The core programs use GPLv3, while some runtime files use LGPL. rsyslog is developed for Linux, POSIX and related UNIX-like systems, and is available through source, Git, distribution packages and Docker. It does not run natively on Windows; a separate Windows Agent collects Event Logs and local log files and can relay syslog to rsyslog on Linux. The core software is free; paid support is available from €1,999/yr.
syslog-ng
syslog-ng collects infrastructure logs, processes them, and routes or stores them for analysis. Its free Open Source Edition can collect, parse, classify, rewrite, and correlate logs before sending them to analysis tools or storing them. Premium Edition adds filtering and real-time pattern correlation to reduce and normalize log data, plus disk buffering, client-side failover, and application-layer acknowledgements. It supports TLS-encrypted transfer and encrypted log storage with X.509 certificates for mutual authentication. Store Box offers access-controlled search and custom reports that can help with compliance work. Listed destinations include Elasticsearch, Hadoop, Kafka, MongoDB, SQL databases, Redis, Splunk, and SIEM tools. Premium licensing is based on Log Source Hosts, with annual support available; Store Box licensing depends on Log Source Hosts and hardware configuration. Open Source Edition is GPL/LGPL licensed and community supported. Commercial customers can access certified engineers and support services; Premium Edition and Store Box offer free trials.