Informatics and Information Processes

FUNCTIONAL COMPARISON OF RSYSLOG AND SYSLOG-NG LOGGING SYSTEMS

M. V. Fedorov , E. R. Patokina
UDC: 004.383.3 Published: 01.06.2026 Issue: Vol. 2 No. 010 (2026): Professionalitet, 2026 DOI: 10.24412/3033-9359-2026-010-5-19
Download PDF

Abstract

The paper presents a functional comparison of two widely used event logging systems for UNIX-like operating systems, rsyslog and syslog-ng. It examines their development history, message-processing architectures, BSD syslog and IETF syslog formats, JSON support, configuration approaches, transport protocols, and mechanisms for protected message transmission over TLS. Particular attention is paid to the practical use of both solutions in the Alt operating system and to selection criteria relevant to corporate infrastructure. Performance testing was carried out on a virtual machine running Alt Workstation 11.1 with 4 vCPUs and 8 GB of RAM. The workload was generated with syslog-perf at 10,000 messages per second, with an average message size of 512 bytes, TCP transport, and a 30-minute steady-state test. The evaluation covered throughput, CPU utilization, memory consumption, message loss, filtering and output performance, and TLS session establishment time. The study is based on 19 sources, including RFC documents and the official documentation for rsyslog, syslog-ng, and Alt. The results show that rsyslog has an advantage in high-load scenarios: it achieved 9,500 messages per second compared with 8,200 messages per second for syslog-ng while using less CPU and memory. syslog-ng, however, provides more convenient built-in support for structured data, flexible routing, and simpler TLS configuration. Based on these findings, practical recommendations are formulated for selecting a logging system according to performance, maintainability, security requirements, and the characteristics of the processed logs.

Online viewer

References

  1. RFC 5424 — The syslog Protocol [Электронный ресурс]. — 2009. — URL: https://www.rfc-editor.org/rfc/rfc5424 (дата обращения: 09.12.2025).
  2. syslog-ng Documentation. History and Overview [Электронный ресурс]. — 2023. — URL: https://www.syslog-ng.com/technical-documents/doc/syslog-ng-open-source-edition (дата обращения: 09.12.2025).
  3. RFC 3164 — The BSD syslog Protocol [Электронный ресурс]. — 2001. — URL: https://www.rfc-editor.org/rfc/rfc3164 (дата обращения: 10.12.2025).
  4. Gerhards R. rsyslog — The Rocket-Fast system for Log Processing / R. Gerhards // Linux Magazine. — 2008.
  5. RFC 5424 — The syslog Protocol [Электронный ресурс]. — 2009. — URL: https://www.rfc-editor.org/rfc/rfc5424 (дата обращения: 10.12.2025).
  6. RFC 5425 — TLS Transport Mapping for syslog [Электронный ресурс]. — 2009. — URL: https://www.rfc-editor.org/rfc/rfc5425 (дата обращения: 10.12.2025).
  7. RFC 5426 — Transmission of syslog Messages over UDP [Электронный ресурс]. — 2009. — URL: https://www.rfc-editor.org/rfc/rfc5426 (дата обращения: 10.12.2025).
  8. syslog-ng 3.0 Release Notes [Электронный ресурс]. — 2009. — URL: https://www.syslog-ng.com/community/b/blog/posts/syslog-ng-3-0-released (дата обращения: 08.12.2025).
  9. Gerhards R. rsyslog — Up and Running / R. Gerhards. — Open Source Press, 2010.
  10. What’s new in syslog-ng 4.0 [Электронный ресурс]. — 2022. — URL: https://www.syslog-ng.com/community/b/blog/posts/what-s-new-in-syslog-ng-4-0 (дата обращения: 08.12.2025).
  11. rsyslog Documentation [Электронный ресурс]. — 2023. — URL: https://www.rsyslog.com/doc/ (дата обращения: 09.12.2025).
  12. Bog BOS: rsyslog — сервер syslog [Электронный ресурс]. — URL: http://www.bog.pp.ru/work/rsyslog.html (дата обращения: 11.12.2025).
  13. Начинаем утреннюю зарядку для тех, кто смотрит нас вечером, или основы сбора логов в ОС Astra Linux Special Edition // Telegraph [Электронный ресурс]. — URL: https://telegra.ph/Osnovy-sbora-logov-v-OS-Astra-Linux (дата обращения: 11.12.2025).
  14. Понимание форматов syslog: быстрое и простое руководство // Last9 [Электронный ресурс]. — URL: https://last9.io/blog/syslog-formats/ (дата обращения: 11.12.2025).
  15. Сбор, парсинг и пересылка логов syslog // Документация платформы NXLog [Электронный ресурс]. — URL: https://nxlog.co/documentation/nxlog-user-guide/syslog.html (дата обращения: 11.12.2025).
  16. syslog RFC3164 против RFC5424 [Электронный ресурс]. — URL: https://devconnected.com/syslog-the-complete-system-administrator-guide/ (дата обращения: 11.12.2025).
  17. Официальная документация ОС «Альт» [Электронный ресурс]. — 2024. — URL: https://www.altlinux.org (дата обращения: 12.12.2025).
  18. rsyslog Security Documentation [Электронный ресурс]. — 2023. — URL: https://www.rsyslog.com/doc/security.html (дата обращения: 10.12.2025).
  19. syslog-ng Security Guide [Электронный ресурс]. — 2023. — URL: https://www.syslog-ng.com/technical-documents/list/syslog-ng-open-source-edition (дата обращения: 10.12.2025).

License

Copyright (c) 2026 M. V. Fedorov, E. R. Patokina (Author)

Creative Commons Attribution (CC BY) 4.0

Keywords

syslog rsyslog syslog-ng Alt security event logs performance