Rsyslog

Rsyslog is an open source implementation of the syslog protocol for UNIX and UNIX-like systems. It extends the original syslogd model with content-based filtering, rich filtering capabilities, flexible configuration options and adds important features to syslog, like using TCP for transport.

Protocol

Rsyslog uses the quasi-standard BSD syslog protocol, specified in RFC 3164. As the text of RFC 3164 is vague and is just an informational description and not a standard, various incompatible extensions of it emerged. rsyslog tries hard to interoperate with a wide variety of devices, and the format of relayed messages can be customized.

The most important extensions of the original protocol endorsed by rsyslog are:
* ISO 8601 timestamp with millisecond granularity and timezone information
* the addition of the name of relays in the host fields to make it possible to track the path a given message has traversed
* reliable transport using TCP
* support GSS-API
* logging directly into a various database engines.

History

The rsyslog project began in 2004, when Rainer Gerhards, the primary author of rsyslog, decided to write a new strong syslog daemon to compete with syslog-ng, because; and acccording to the author "A new major player will prevent monocultures and provide a rich freedom of choice" [http://blog.gerhards.net/2007/08/why-does-world-need-another-syslogd.html] .

Distributions

rsyslog is available for a number of unix systems and linux distributions, Among others: [http://wiki.rsyslog.com/index.php/Platforms]
* AIX
* Debian Linux
* Red Hat Enterprise Linux
* Solaris
* Fedora (In November 2007, rsyslog has become the default syslogd for the Fedora project)
* FreeBSD
* Ubuntu

Related RFCs & Working Groups

* RFC 3164 - The BSD syslog Protocol

External links

* [http://www.rsyslog.com/ rsyslog home page]