syslog-ng Reviews

Name: syslog-ng
Brand: One Identity
Rating: 4.3 (5 reviews)

4.3 out of 5

5 reviews
100% willing to recommend

What is syslog-ng?

Optimizing SIEM
syslog-ng is the log management solution that improves the performance of your SIEM solution by reducing the amount and improving the quality of data feeding your SIEM.

Get the Log Management Buyer's Guide and find out what your peers are saying about syslog-ng, Wazuh, Datadog and more!

syslog-ng is the #19 ranked solution in Log Management Software. PeerSpot users give syslog-ng an average rating of 8.6 out of 10. syslog-ng is most commonly compared to Wazuh: syslog-ng vs Wazuh. syslog-ng is popular among the large enterprise segment, accounting for 59% of users researching this solution on PeerSpot. The top industry researching this solution are professionals from a computer software company, accounting for 13% of all views.

Buyer's Guide

Log Management

March 2025

Get the category report

Helped 845,406 peers since 2012

Featured syslog-ng reviews

RyanVargas

Senior Director and Senior Systems Engineer (Dual Role), IT Infrastructure and Security at a financial services firm with 51-200 employees

I rate syslog-ng 10 out of 10. It's free and easy to use. It has built-in tools that help us index the various logs sent to it. It's a solid log product. If you're looking for a SIEM solution, syslog-ng will work as a stopgap measure at beginning of the project. It can also work as an injector for a true SIEM solution. You can send all the logs to syslog-ng and forward all the data to the SIEM solution after you've cleaned up the data and got the pertinent information. It's a good front end for a commercial SIEM solution, which becomes more expensive as you load more data into it. I would highly recommend syslog-ng for that use case. However, if you lack the expertise, you might need to go with a cloud-based SIEM instead. You need some in-house expertise or an outside consultant to manage it and set it up.

Read full review

FlavioSantos

Data center analyst at Atvos

We use it for compliance issues, like law enforcement for the Brazilian government For us, the most valuable feature is the use of compound search for searching logs at a specific time, by a specific user, or specific behavior. There is room for improvement in terms of observability.…

Read full review

ShabbeerNasrudeen

Solution Architect(Splunk- Log Management) at Tata Consultancy

Syslog is mainly used for network logs, and it can be configured to support a number of ports for an IP. From a scalability perspective, a front-end load balancer or other third-party elements can be used to route traffic to syslog. However, syslog will always look for the standard log format. If the format is not up to the standard syslog level, the load balancer will add its own IP to the log and forward it to syslog. To ensure integrity, the log should remain the same, without any changes to the server A IP. If there is a change in the login server A, the load balancer will add its own IP or hostname to the log and forward it to syslog. To address this issue, further investigation is needed to enable the product to overcome this scenario. We have 12 technicians supporting the platform.

Read full review

syslog-ng mindshare

As of April 2025, the mindshare of syslog-ng in the Log Management category stands at 2.6%, down from 2.7% compared to the previous year, according to calculations based on PeerSpot user engagement data.

Log Management

Key learnings from peers

Valuable Features

Syslog-ng offers features like built-in alerts for SIEM, a separate configuration file, and the capability to extract and store logs. It allows easy access and helps show precise incident locations. Users appreciate integration with multiple platforms for real-time monitoring and compound search capabilities for logs by time, user, or behavior.

"For us, the most valuable feature is the use of compound search for searching logs at a specific time, by a specific user, or specific behavior."
"The ability to extract and store the logs is the most valuable feature of syslog-ng."
"Syslog-ng provides easy access to all my logs. It helps me show managers and other clients precisely where an incident occurred. I also like it because you can integrate syslog-ng with multiple solutions to allow real-time monitoring."

Room for Improvement

Syslog-ng requires expertise for SIEM use cases as its filtering lacks depth, which could be enhanced with additional methods. Logging improvements are needed, including fine-tuning and level modification. There is a shortage of knowledgeable professionals leading to integration issues, such as misconfiguration and naming errors. Room for protocol extensions and observability improvements exists, alongside a desire for Kafka integration.

"There is room for improvement in terms of observability."
"There is always the potential for additional integration and protocol extensions."
"It's hard to find people who know how to use syslog-ng. I often find problems with configurations, and solutions aren't integrated correctly with syslog-ng. For example, there might be data with extra decimals, or the collector agents are incorrectly named. It isn't a problem with the solution; it's a lack of professionals."

Pricing

syslog-ng is open-source and free.

"Syslog-ng is open-source."
"Syslog-ng is a free open-source solution."

Popular Use Cases

Syslog-ng is employed to aggregate and filter logs, serving as a temporary SIEM alternative. It is utilized to automate tasks without a user interface for customer implementations. Users also conduct enterprise security audits to ensure compliance with data regulations such as GDPR in Brazil. Additionally, it addresses compliance issues related to Brazilian government law enforcement. Syslog-ng aids in log management and data regulation compliance for various entities.

Deployment

Syslog-ng's initial setup is rated highly for ease, described as a straightforward, cookie-cutter process. Users suggest improvements, like including all dependent packages in one download for simpler installation. Despite familiarity, many find managing or configuring syslog-ng challenging. In installations, about three or four people are usually involved. The documentation supports a smooth process, with users rating their experience as nine out of ten for setup simplicity.

Stability

Syslog-ng performs consistently well according to users. They report no service disruptions and encounter no issues except when there's a buffer workflow, likely due to storage challenges. This software efficiently manages large data volumes without memory or processing problems. Users rate its stability at nine out of ten, indicating a high level of confidence in its reliability.

These insights are based on the in-depth reviews provided by peers to help you make a better buying decision.

Download our Log Management Buyer's Guide for additional reliable information.

Top industries

By visitors reading reviews

Government

13%

Computer Software Company

13%

Manufacturing Company

Financial Services Firm

University

Educational Organization

Energy/Utilities Company

Comms Service Provider

Healthcare Company

Insurance Company

Media Company

Hospitality Company

Retailer

Construction Company

Transportation Company

Non Profit

Wholesaler/Distributor

Outsourcing Company

Pharma/Biotech Company

Legal Firm

Real Estate/Law Firm

Marketing Services Firm

Aerospace/Defense Firm

Performing Arts

Recreational Facilities/Services Company

Engineering Company

Consumer Goods Company

Logistics Company

Compare syslog-ng with alternative products

Learn more about syslog-ng

Rapid search and troubleshooting
With syslog-ng Store Box, you can find the answer. Search billions of logs in seconds using full text queries with Boolean operators to pinpoint critical logs.

Meeting compliance requirements
syslog-ng Store Box provides secure, tamper-proof storage and custom reporting to demonstrate compliance.

Big data ingestion
syslog-ng can deliver data from a wide variety of sources to Hadoop, Elasticsearch, MongoDB, and Kafka as well as many others.

Universal log collection and routing
syslog-ng flexibly routes log data from X sources to Y destinations. Instead of deploying multiple agents on hosts, organizations can unify their log data collection and management.

Secure data archive
syslog-ng Store Box provides automated archiving, tamper-proof encrypted storage, granular access controls to protect log data. The largest appliance can store up to 10TB of raw logs.