Rsyslog is the current, high-performance and de-facto implementation of the syslog server originally developed in the 1980s by Eric Allman as a part Sendmail on BSD 4.2, and later released as a separate service in BSD 4.3. Rsyslog was a rewrite from scratch first released in 2004, and added support for TCP transport (syslog only provided for the unreliable UDP transport protocol), and adds things like rich, content-based filtering, queued operations and more, and implements RFC 3164, RFC 5424, RFC 5425 and RFC 5426, as well as ISO 8601 timestamps, to name a few of the long list of features. Unlike the original syslog, which only provided limited support for sending logs to an external program using named pipes, rsyslog fully integrates the support for using programs, as well as logging directly into databases. It is often packaged as a part of various Linux and BSD distros.

Additional resources include:

  • The rsyslog page on Wikipedia, which includes links to other resources like the related RFCs.
  • The rsyslog homepage, where you can find a first steps guide, basic configuration reference and more.
Slug
rsyslog