Blog

Streaming syslog-ng data to your lakehouse using OpenTelemetry

Peter Czanik — Wed, 15 Apr 2026 11:58:53 GMT

Version 4.11.0 of syslog-ng contains contributions from Databricks related to OAuth2 authentication. Recently, they published a blog about how this enables their customers to send logs to their data lake using syslog-ng and the OpenTelemetry protocol...(read more)

The syslog-ng Insider 2026-04: wildcard-file; fix; UDP

Peter Czanik — Wed, 08 Apr 2026 13:31:20 GMT

Dear syslog-ng users, This is the 139th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS Automatic configuration of the syslog-ng wildcard-file() source Reading files and monitoring directories became a l...(read more)

Compiling syslog-ng on an old Mac

Peter Czanik — Tue, 24 Mar 2026 09:06:04 GMT

I have an aging, but fully functional MacBook. I bought it for syslog-ng testing, but I also use for watching movies. Homebrew no more fully supports old, Intel-based Macs. This blog helps to compile the latest syslog-ng release on these old, but oth...(read more)

Central log collection - more than just compliance

Peter Czanik — Wed, 18 Mar 2026 12:05:25 GMT

I often hear, even at security conferences that “no central log collection here” or “we have something due to compliance”. Central logging is more than just compliance. It makes logs easier to use, available and secure, thus m...(read more)

The syslog-ng Insider 2026-03: 4.11.0 release; OpenSearch; ElasticSearch

Peter Czanik — Wed, 11 Mar 2026 11:56:33 GMT

Dear syslog-ng users, This is the 138th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS Version 4.11.0 of syslog-ng is now available Version 4.11.0 of syslog-ng is now available. The main attraction is ...(read more)

Syslog-ng 4.11.0 packaging status

Peter Czanik — Tue, 03 Mar 2026 13:13:11 GMT

Committed users compile syslog-ng for themselves from source. However, most of us wait until a software is available as an easy-to-install package for our operating system of choice. In this blog post, you will see an overview on the available packag...(read more)

Version 4.11.0 of syslog-ng is now available

Peter Czanik — Wed, 25 Feb 2026 12:13:23 GMT

Version 4.11.0 of syslog-ng is now available. The main attraction is the brand new Kafka source, but there are many other smaller features and improvements, as well. Before you begin If you happen to use Debian, Ubuntu or the RHEL family of operating...(read more)

UDP reliability improved in syslog-ng Debian packaging

Peter Czanik — Tue, 17 Feb 2026 13:41:12 GMT

UDP log collection is a legacy feature that does not provide any security or reliability, but is still in wide use. You can improve its reliability using eBPF on Linux in recent syslog-ng versions. Support for eBPF was added to Debian packages while ...(read more)

The syslog-ng Insider 2026-02: stats-exporter; blank filter; Kafka source

Peter Czanik — Thu, 12 Feb 2026 14:15:15 GMT

Dear syslog-ng users, This is the 137th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS The syslog-ng stats-exporter() now has all functionality of syslog-ng-ctl The syslog-ng stats-exporter() allows yo...(read more)

What to fix next in syslog-ng?

Peter Czanik — Wed, 04 Feb 2026 13:05:48 GMT

Version 4.11 of syslog-ng will feature a brand-new Kafka source. While it is being tested and reviewed, we are working on reducing the number of open issues. What should be fixed next? Two weeks ago, I wrote about testing the upcoming syslog-ng 4.11 ...(read more)

Automatic configuration of the syslog-ng wildcard-file() source

Peter Czanik — Wed, 28 Jan 2026 11:54:06 GMT

Reading files and monitoring directories became a lot more efficient in recent syslog-ng releases. However, it is also needed manual configuration. Version 4.11 of syslog-ng can automatically configure the optimal setting for both. If you follow my b...(read more)

Call for testing: syslog-ng 4.11 is coming

Peter Czanik — Tue, 20 Jan 2026 12:27:26 GMT

The syslog-ng 4.11 release is right around the corner. Thousands of automatic tests run before each new piece of source code is merged, but nothing can replace real-world hands-on tests. So help us testing Elasticsearch / OpenSearch data-streams, Kaf...(read more)

Changes in the syslog-ng Elasticsearch destination

Peter Czanik — Tue, 13 Jan 2026 13:18:27 GMT

While testing the latest Elasticsearch release with syslog-ng, I realized that there was already a not fully documented elasticsearch-datastream() driver. Instead of fixing the docs, I reworked the elasticsearch-http() destination to support data str...(read more)

Using OpenSearch data streams in syslog-ng

Peter Czanik — Wed, 17 Dec 2025 12:12:48 GMT

Recently, one of our power users contributed OpenSearch data streams support to syslog-ng, which reminded me to also do some minimal testing on the latest OpenSearch release with syslog-ng. TL;DR: both worked just fine. Before you begin Adding data s...(read more)

The syslog-ng Insider 2025-12: logrotation; release RPM; nightly RPM

Peter Czanik — Thu, 11 Dec 2025 11:55:51 GMT

Dear syslog-ng users, This is the 136th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS File size-based log rotation in syslog-ng Version 4.10 of syslog-ng introduced file size-based log rotation. Thank...(read more)