# Rsyslog

> Mediated Wiki article. Canonical URL: https://mediated.wiki/source/Rsyslog
> Markdown URL: https://mediated.wiki/source/Rsyslog.md
> Source: https://en.wikipedia.org/wiki/Rsyslog
> Source revision: 1324143798
> License: Creative Commons Attribution-ShareAlike 4.0 International (https://creativecommons.org/licenses/by-sa/4.0/)

{{Short description|System log utility}}
{{Infobox software
| name                    = Rsyslog
| logo                    =
| released                = 2004 <!-- {{Start date|YYYY|MM|DD}} -->
| screenshot              =
| caption                 =
| collapsible             =
| author                  = Rainer Gerhards
| developer               =
| discontinued            =
| latest release version = {{wikidata|property|reference|P348}}
| latest release date    = {{start date and age|{{wikidata|qualifier|P348|P577}}}}
| frequently updated      =
| programming language    = [C](/source/C_(programming_language))
| operating system        = [Unix-like](/source/Unix-like)
| platform                =
| size                    =
| language                =
| status                  =
| genre                   = System logging
| license                 = [GNU General Public License](/source/GNU_General_Public_License) v3
| website                 = {{official URL}}
}}

'''Rsyslog''' is an [open-source](/source/Open-source_software) software utility used on [UNIX](/source/UNIX) and [Unix-like](/source/Unix-like) computer systems for forwarding [log messages](/source/Data_logging) in an [IP](/source/Internet_Protocol) [network](/source/Computer_Network). It implements the basic [syslog](/source/syslog) protocol, extends it with content-based filtering, rich filtering capabilities, queued operations to handle offline outputs,<ref>{{Cite web|url=http://man7.org/linux/man-pages/man5/rsyslog.conf.5.html#QUEUED_OPERATIONS|title = Rsyslog.conf(5) - Linux manual page}}</ref> 
support for different module outputs,<ref>{{Cite web|url=https://www.rsyslog.com/doc/v8-stable/configuration/modules/idx_output.html|title=RSyslog Documentation}}</ref> flexible configuration options and adds features such as using [TCP](/source/Transmission_Control_Protocol) for transport.

The official RSYSLOG website defines the utility as "the Rocket-fast SYStem for LOG processing pipelines".<ref>
{{cite web
| url           = http://www.rsyslog.com/
| title         = rsyslog
| website       = rsyslog.com
| accessdate    = 2025-10-30
| quote         = RSYSLOG is the '''r'''ocket-fast '''sys'''tem for '''log''' processing pipelines.
}}
</ref>

== Protocol ==
Rsyslog uses the standard [BSD](/source/BSD) syslog protocol, specified in [RFC](/source/Request_for_Comments) 3164. As the text of RFC 3164 is an informational description and not a standard, various incompatible extensions of it emerged. Rsyslog supports many of these extensions. The format of relayed messages can be customized.

The most important extensions of the original protocol supported by rsyslog are:
* [ISO 8601](/source/ISO_8601) timestamp with millisecond granularity and time zone information
* the addition of the name of relays in the host fields to make it possible to track the path a given message has traversed
* reliable transport using [TCP](/source/Transmission_Control_Protocol)
* support [GSS-API](/source/Generic_Security_Services_Application_Program_Interface) and [TLS](/source/Transport_Layer_Security)
* logging directly into various database engines.
* support for RFC 5424, RFC 5425, RFC 5426
* support for [RELP](/source/Reliable_Event_Logging_Protocol)
* support for buffered operation modes where messages are buffered locally if the receiver is not ready
* complete input/output support for [systemd journal](/source/systemd)

== History ==
The rsyslog project began in 2004, when Rainer Gerhards, the primary author of rsyslog,<ref>{{Cite web |last=Binnie |first=Chris |date=2016-11-30 |title=Remote Logging With Syslog, Part 1: The Basics |url=https://www.linux.com/topic/networking/remote-logging-syslog-part-1-basics/ |access-date=2025-11-25 |website=Linux.com |language=en-US}}</ref> decided to write a new strong syslog daemon to compete with [syslog-ng](/source/syslog-ng), because, according to the author, "A new major player will prevent monocultures and provide a rich freedom of choice."<ref>{{cite web |url=https://rainer.gerhards.net/2007/08/why-doesworld-need-another-syslogd.html |title=Why does the world need another syslog?|date=August 12, 2007|accessdate=October 31, 2018}}</ref>
Rainer Gerhards worked on rsyslog inside his own company, Adiscon GmbH.

== Related RFCs and working groups ==
* [RFC 3164](/source/rfc%3A3164) - The BSD syslog Protocol (obsoleted by [RFC 5424](/source/rfc%3A5424))
* [RFC 5424](/source/rfc%3A5424) - The Syslog Protocol (obsoletes [RFC 3164](/source/rfc%3A3164))
* [RFC 5425](/source/rfc%3A5425) - Transport Layer Security Mapping for Syslog
* [RFC 5426](/source/rfc%3A5426) - Transmission of Syslog Messages over UDP

== See also ==
{{Portal|Free and open-source software}}
* [NXLog](/source/NXLog)
* [fluentd](/source/fluentd)
* [journald](/source/journald) – incorporates [syslog](/source/syslog)-like functionality
* [syslog-ng](/source/syslog-ng)

== References ==
{{reflist}}

== External links ==
* {{Official website}}
* {{github|rsyslog/rsyslog}}
* {{Freshmeat|rsyslog}}

Category:Logging software
Category:Internet protocols
Category:Internet Standards
Category:System administration
Category:Network management
Category:Free network-related software

---
Adapted from the Wikipedia article [Rsyslog](https://en.wikipedia.org/wiki/Rsyslog) by Wikipedia contributors ([contributor history](https://en.wikipedia.org/wiki/Rsyslog?action=history)). Available under [Creative Commons Attribution-ShareAlike 4.0 International](https://creativecommons.org/licenses/by-sa/4.0/). Changes may have been made.