The syslog-ng application is not log analysis software. It can filter log messages and select only the ones matching certain criteria. It can even convert the messages and restructure them to a predefined format, or parse the messages and segment them into different fields. But syslog-ng cannot interpret and analyze the meaning behind the messages, or recognize patterns in the occurrence of different messages.
Log messages contain information about the events happening on the hosts. Monitoring system events is essential for security and system health monitoring reasons.
The original syslog protocol separates messages based on the priority of the message and the facility sending the message. These two parameters alone are often inadequate to consistently classify messages, as many applications might use the same facility, and the facility itself is not even included in the log message. To make things worse, many log messages contain unimportant information. The syslog-ng application helps you to select only the really interesting messages, and forward them to a central server.
Company policies or other regulations often require log messages to be archived. Storing the important messages in a central location greatly simplifies this process.
Version 3.20 of syslog-ng Open Source Edition includes the following main features.
You can now directly send messages to the collectd daemon. Many thanks for Fabien Wernli for contributing this destination to syslog-ng OSE.For details, see "collectd: sending metrics to collectd" in the Administration Guide.
The Websense Parser can parse the log messages of Websense Content Gateway (Raytheon|Websense, now Forcepoint). These messages do not completely comply with the syslog RFCs, making them difficult to parse. The websense-parser() of syslog-ng OSE solves this problem, and can separate these log messages to name-value pairs. For details, see Administration Guide.
The Netskope Parser can parse Netskope log messages. These messages do not completely comply with the syslog RFCs, making them difficult to parse. The netskope-parser() of syslog-ng OSE solves this problem, and can separate these log messages to name-value pairs. For details, see Administration Guide.
The persist-tool utility is now part of the syslog-ng OSE package. For details, see the persist-tool manual page.
By default, syslog-ng OSE closes destination sockets if it receives any input from the socket (for example, a reply). From now on, if the close-on-input() option of the unix-stream() is set to no, syslog-ng OSE just ignores the input, but does not close the socket.
Since ElasticSearch version 1.x has reached its end of life, its support has been removed from syslog-ng OSE. Use the elasticsearch2 destination instead.
The syslog-ng application is used worldwide by companies and institutions who collect and manage the logs of several hosts, and want to store them in a centralized, organized way. Using syslog-ng is particularly advantageous for:
Internet Service Providers
Financial institutions and companies requiring policy compliance
Server, web, and application hosting companies
Wide area network (WAN) operators
Server farm administrators.