I'm trying to figure out the best way to setup a central place to store and interrogate server logs. syslog, Apache, MySQL etc.

I've found a few different options but I'm not sure what would be best. I'm looking for something that is easy to install and keep updated on many virtual machines. I can add it to a VM template going forward but I'd also like it to be easy to install to keep the VM complexity down.

The options I've found so far are:

  • syslogd
  • syslog-ng
  • rsyslog
  • syslogd/syslog-ng/rsyslog to logstash/ElasticSearch
  • logstash agent in each log "client" to send to Redis/logstash/ElasticSearch

And all sorts of permutations of the above.

What's the most resilient and light from the log "client" perspective?
I'd like to avoid the situation where log "clients" hang because they are unable to send their logs to the logging server. Also I would still like to keep local logging and the rotation/retention provided by logrotate in place.

Any ideas/suggestions or reasons for or against any of the above?
Or suggestions of a different structure entirely?

  • I have big confused same to you. Any one have point please let me know? Regards, – user149750 Dec 15 '12 at 9:45

I'd say the best reliable option at this point (exluding comerial software solutions) is pure syslog-ng

  • Is it more reliable than pure rsyslog? – batfastad Dec 17 '12 at 17:35
  • 1
    rsyslog is more reliable because of relp – user130370 Dec 19 '12 at 10:01
  • @EricDANNIELOU that's exactly what I thought and why I have been evaluating rsyslog :) – batfastad Dec 19 '12 at 15:02
  • I wouldn't go as far to say that rsyslog is more reliable. It is nowhere near as mature as syslog-ng. However, it does offer some features for free that would otherwise cost money for the syslog-ng pro version (such as disk-based buffering). – Clayton Dukes Aug 26 '13 at 18:24

I think the best is syslog-ng, easy to configure, very easy to maintain, nice and powrful tool. BTW, if you have not more than 500M logs per day, you can look into splunk, all you need is to add log-forwarder to the machine image and configure a few files, it will work as magic:) It has a lot of application for different kind of log types, nice parsing etc. All depends on what do you need.


Until very recently, we were using rsyslog with graylog for centralized logging. It worked very, very well. This uses the GELF protocol, which also has the advantage of having libraries in various programming languages.

That said, we are switching to Loggly as it's cheaper than maintaining our own centralized logging server. Since Loggly recommends syslog-ng, we're evaluating switching to that as well, although rsyslog seems a bit better - eg. rsyslog recipes for things like log caching when networking is lost and support for GELF.

  • the OP asked for a client, not a log server/analyzer – Clayton Dukes Aug 26 '13 at 18:23

A recent rsyslog would probably be one of the fastest and lightest options. You get disk&memory buffers for free and you can output to Elasticsearch via omelasticsearch. Here's a blog post that might get you started on something like this:


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.