We chose syslog-ng because it is easy to install, easy to maintain, easy to update, and due to the fact that all data arrive in raw format, we can manipulate it as we want.
Syslog-ng offers built-in features for alert creation in SIEM and easy log access aiding in incident analysis. It supports real-time monitoring through multiple solution integrations and includes a separate config file alongside core setup. While valued for log extraction, its filtering and observability need enhancement. Configurations can be challenging, and finding experts is difficult. Potential exists for further integration and protocol extensions.
