https://syslog-ng-future.blog/syslog-ng-relaunch/ syslog-ng-future.blogsyslog-ng-future.blog * Blog * About * Contact Select Page syslog-ng relaunch by Balazs Scheidler | Jan 19, 2022 | background | 3 comments syslog-ng relaunchsyslog-ng relaunch syslog-ng has been around for decades: I started coding the first version of syslog-ng in September 1998, circa 24 years ago. The adoption of syslog-ng skyrocketed soon after that: people installed it in place of the traditional syslogd across the globe. It was packaged for Debian, Gentoo, SUSE and even commercial UNIXes. It became a default logging daemon in some of these Linux distributions. Commercial products started embedding it as a system component. Over the years however I feel that syslog-ng has become a trusted piece of infrastructure, few people really care about. I set out to change that. The use of syslog-ng has become so widespread and dominant, needing minimal maintenance, that after a point, people stopped noticing its existence. It became like the printer sitting in an office corner: we know it's there, we use it regularly, we appreciate the function but we don't really know or care about the details or the brand providing us with given service. I see syslog-ng regularly in this spot today: its deployment might have been a big project in its time with its own challenges, but it has been a solved problem ever since. Not that log management and log processing would be a static, boring field of IT & IT Security. Like all other fields of enterprise IT, there's been tremendous activity in the last 10-15 years. Markets and relevant trends: * SIEM & User Behavior Analytics(LogLogic, ArcSight, QRadar, Splunk, ...) * Big Data (Hadoop, Kafka, Storm, Spark, NiFi) * Enterprise SaaS services (Office365, Google Workspace, etc.) * Containers and orchestration (Kubernetes, OpenShift, cloud & on-prem) * Cloud Native Applications All these changes naturally resulted in an equal frenzy in the tools processing and managing log data. New tools and services emerged, old tools gained new features. I could probably go on and get into details on these trends but that's not why I am here today. I started this blog as I wanted to show two things: 1. That syslog-ng has not been the stoic figure in the corner and has incorporated important improvements over the years that are not widely known and unfortunately not even assumed. 2. To solicit feedback on my future plans and with that help guide the development of syslog-ng to the future. The intent behind this blog is to address the 2nd point. The first point might sound a little strange at first: if there are indeed functionality in syslog-ng that its users don't know or care about, that can only mean one of two things: 1. Those features were not needed in the first place. 2. The marketing/communication of syslog-ng as a project has not been very good. As one of the engineers behind the changes I firmly believe #1 is not true. The features we added to syslog-ng over the years are important. I believe these features enable syslog-ng to address problems that only few people assume it could address. But I am not here to go into details on those features either. My take on the marketing issue is different: other projects, open source or commercial, have been better at communicating their value propositions. They were more successful at communicating their release-by-release improvements and with that gained a more significant traction in the marketplace. The reason behind this failure is an entire post on its own (let me know if you are interested!), my short and simple summary is a single word: focus. I am the founder of the syslog-ng project. I founded a company that sponsored the syslog-ng project. But neither my or my company's primary focus has ever been syslog-ng. Some of you may remember that syslog-ng was hosted on balabit.com. Balabit was a player in the Privileged Access Management space (e.g. the likes of CyberArk, BeyondTrust, e-DMZ, Wallix etc). Albeit we made an effort to combine log management with PAM, but truth be told we never really succeeded in doing so. syslog-ng grew from being my personal hobby to become the 2nd product in the Balabit portfolio. This situation handicapped syslog-ng compared to those projects and companies that had logs as their primary focus. Balabit was acquired 4 years ago: I spent my sabbatical, I learnt a couple of new hobbies (electronics mainly, welding is something I still want to learn), implemented home automation in my house (see http://bazsi.blogspot.com/), became a hobby angel investor and a management consultant. With all that I am somewhat bored. I love spending time with my family all these new things, but at the same time I need new challenges. There are too many "small" things I spend my time with and I have an itch to do something "bigger". I want to give syslog-ng a chance it never had: I want to make it my primary focus. The foundations and the technology are already there, let's put the spotlights on, blow the dust off. Engage with users, understand their needs and communicate value. Understand things that are missing and fix them. In a nutshell, I would like to relaunch syslog-ng as a project. Let's reboot the process that keeps a product able to adapt to a changing market and continue to be relevant for more decades to come. I am inviting you to be a part of it. Feedback, new use cases, feature requests and even bug reports are welcome. Strong points that you like, weak spots that you would like to see improved are very interesting. Subscribe below and help me in this endeavour. Stay tuned! Subscribing to this blog shows interest, interest brings motivation, motivation brings features and bugfixes to syslog-ng. Please show your appreciation and interest by subscribing. Thanks. Subscribe 3 Comments 1. sysadmin on 02/01/2022 at 9:53 am In our infrastructure, syslog-ng is responsible for collecting syslog from our Cisco routers and UNIX systems (different flavours), some apps. We then use syslog-ng filters to sort the incoming data into various local files in the filesystem. This data is then polled by Splunk Heavy Forwarders and transferred to a local Splunk we use as an SIEM. We maintain the syslog-ng config file manually, which has grown quite large over time. It has become a challenge to navigate in it. The syntax is something that we need to teach to newcomers. This is an RHEL7 system and we are using syslog-ng 3.5.6 from EPEL. We have 1-2k msg/sec. We are generally happy, syslog-ng just works. It would be great if the maintenance of the configuration could be simplified, especially to less experienced staff. Reply 2. Ville Laurikari on 02/01/2022 at 10:54 am Firstly, congrats on finding your focus! We currently use just rsyslog as a central log repository. Our needs are sort of simple: - compliance (and good sense) require us to log "everything" centrally - access to logs is controlled - alerting and monitoring is mostly taken care of by systems like Sentry, prometheus, and alertmanager - We still need to watch the kernel OOM killer, uwsgi harakiri, unexpected ufw log entries, etc. Additionally, we've been thinking of having two separate destinations (or signing logs?) to ensure no-one can tamper with the logs after they were originally emitted. I should note that we certainly don't want an "applicance" for this. Yuck. So, I'm wondering what does syslog-ng provide that rsyslog doesn't? Originally, I actually thought about setting up syslog-ng because I thought it might be better. But it wasn't just an "apt-get install", or at least there was no website to tell me what to do. All I could find were websites with marketing webcasts and products-solutions-resources corporate bullshit. Rsyslog was easier, so that's what I went thing. Reply + Balazs Scheidler on 02/01/2022 at 3:48 pm Thanks Ville for your input. It is unfortunate that syslog-ng's packaging situation has deteriorated over time in the past. One of my initial posts on this site I prepared for launch is touching on this topic: https:// syslog-ng-future.blog/ syslog-ng-distribution-and-support-bottleneck/ On the other hand, syslog-ng is usually regarded very good by its users in these areas: - configuration language is easier to read and understand, still very powerful - the quality of the documentation - good acceptance of syslog data broken in various ways (e.g. non standard formats). - feeding SIEMs like Splunk directly (over HTTP) And a solid, stable and performant solution that is improved continuously at an 8-10 weeks release cadence. Generally the "gap" that I would like to address is to be the log "midlayer" that connects sources and SIEMs (+other consumers) in an easy to deploy fashion. Applications (and OSs) mess up logging far too often, they are logging for many different purposes (monitoring, observability/troubleshooting and security) and they are unable to adhere to any logging standards out there. In many cases a log emitted by an application makes it quite hard to use it in something like Splunk or another SIEM. For instance timestamps are messed up quite often, use formats that make it difficult to extract fields, a single event spanning a lot of messages and so on. There is often an "impedance mismatch" between the apps and the SIEMs, which can be straightened out by something like syslog-ng. Kafka or other queueing mechanisms are "dumb", they will not change the messages they carry. syslog-ng can do that if needed. But, logs by a single application is just one thing, it is also a problem that the syslog message stream is a mixture of logs from all kind of applications, identifying the application alone is complex. Recognizing the application, device/host or even the proper timezone is difficult. I would like to focus on making these much easier than today AND at the same time to focus on the deployment/ infrastructure site as well. If you use rsyslog and it fulfils its purpose, I might not be able to convince you to change. If you hit a complexity however that stems from an application + SIEM combination that you don't want to fix manually yourself, I might Reply Submit a Comment Cancel reply Your email address will not be published. Required fields are marked * [ ] [ ] [ ] [ ] [ ] [ ] [ ] Comment * [ ] Name * [ ] Email * [ ] Website [ ] [ ] Save my name, email, and website in this browser for the next time I comment. Submit Comment [ ] [ ] [ ] [ ] [ ] [ ] [ ] D[ ] Search for: [ ] [Search] Recent Posts * syslog-ng distribution and support bottleneck * syslog-ng-future.blog? Is this a fork or what? * syslog-ng relaunch Recent Comments * Balazs Scheidler on syslog-ng relaunch * Ville Laurikari on syslog-ng relaunch * sysadmin on syslog-ng relaunch Archives * January 2022 Categories * background * technology Privacy Privacy Policy We are using cookies to give you the best experience on our website. You can find out more about which cookies we are using or switch them off in settings. Accept Close GDPR Cookie Settings syslog-ng future blogsyslog-ng future blog * Privacy Overview * Strictly Necessary Cookies * 3rd Party Cookies * Cookie Policy Privacy Overview This website uses cookies so that we can provide you with the best user experience possible. Cookie information is stored in your browser and performs functions such as recognising you when you return to our website and helping our team to understand which sections of the website you find most interesting and useful. Strictly Necessary Cookies Strictly Necessary Cookie should be enabled at all times so that we can save your preferences for cookie settings. Enable or Disable Cookies [ ] If you disable this cookie, we will not be able to save your preferences. This means that every time you visit this website you will need to enable or disable cookies again. 3rd Party Cookies This website uses Google Analytics to collect anonymous information such as the number of visitors to the site, and the most popular pages. Keeping this cookie enabled helps us to improve our website. Enable or Disable Cookies [ ] Please enable Strictly Necessary Cookies first so that we can save your preferences! Cookie Policy More information about my Cookie Policy Enable All Save Changes