logoalt Hacker News

brianjlogantoday at 6:33 PM5 repliesview on HN

> A syslog server is a foundational tool for centralized log management in modern IT environments

I'd very much recommend a more modern log stack than a traditional syslog server.

There are many articles covering the limitations of Syslog. Better to replace that component by utilities like OpenTelemetry and JSON structured logging.

You can run a single binary version of Loki https://grafana.com/docs/loki/latest/get-started/deployment-...

Or use something like the Otel collector to send your logs to a remote host.

I have done my fair share of rsyslog and syslog-ng.

I would not say a "Syslog" server belongs in a modern stack.


Replies

skullonetoday at 6:39 PM

I disagree. I work in a large environment, and rsyslog is where 90% of data goes to first. It can keep up with millions of messages per second, route them to higher order services for indexing (bigquery, splunk, elastic etc etc). Has rules engines, encryption, supports multiple protocols and obviously has TLS too. You can surely augment with otel and such where you can, but syslog is uhhhh, deployed in so many places that it would make an average app developer's head spin when all they're used to is application logging in a controlled structured place in their silo.

show 2 replies
aftbittoday at 8:43 PM

Disagree. JSON logging is fine, but make it line based and just log to a syslog server. Then I can route it wherever I want (or to multiple places) including to a simple file on a disk that I can actually inspect, rather than having to use an API.

1970-01-01today at 7:33 PM

The problem with modern stuff is it doesn't do the very basics. Sometimes I really do want UDP dumping out into a file on another part of the network. The modern setups forget how to do this.

show 1 reply
Exoristostoday at 9:31 PM

I've been down this road many times over the years, and each new promised land of logging always fails to replace syslog for me. Nothing else is as widely-compatible and performant. Fortunately, there are some great tools out there to modernize the network-admin experience: syslog-ng is a favorite of mine.

lokartoday at 7:07 PM

Yeah, for a modern large scale distributed system both the client api and implementations are pretty bad.