[opensourcedex]

rsyslog is a free, open source monitoring & observability project written in C and released under LGPL-3.0. It has 2,345 GitHub stars, 743 forks and 207 open issues, and was last pushed 9 hours ago. On this registry it ranks #160 of 270 tracked projects in Monitoring & Observability, with 5 head-to-head comparisons available. It gained 8 stars over the last 30 tracked days.

What is rsyslog?

Rsyslog is a high-performance log ingestion and ETL engine written in C and released under the LGPL-3.0, built for operators and engineers who must take in, transform, and route very large volumes of log data from many sources to many destinations.

What it is

Rsyslog is a rocket-fast system for log processing pipelines. It has a modular, microkernel-like architecture: a small core handles message flow while functionality is loaded through modules, which is how data can be ingested from numerous sources, transformed, and then written to a wide variety of destinations. It began life as a regular syslogd and has evolved into a general-purpose logging solution rather than a single-purpose daemon.

The concrete problem it solves is scale and routing in the syslog ecosystem. Plain syslogd forwards messages, but it does not give operators a pipeline for reshaping and distributing those messages across heterogeneous back ends. Rsyslog replaces that baseline daemon with an engine that can deliver over one million messages per second to local destinations under minimal processing, a figure measured on v7 in December 2013. Even when complex routing and remote forwarding are in play, the project states that performance remains excellent, so the same tool covers both the simple local collection case and the distributed forwarding case.

Key capabilities

  • Ingests log data from numerous sources, then transforms it, then outputs it to a wide variety of destinations in one pipeline.
  • Runs a modular microkernel-like architecture, so ingestion, parsing, and output functionality is selected per deployment.
  • Delivers over one million messages per second to local destinations under minimal processing, based on v7, December 2013.
  • Sustains complex routing and remote forwarding while keeping performance strong.
  • Ships output integrations reflected in the project topics: Elasticsearch, Kafka, and MongoDB alongside core syslog handling.
  • Provides project-built packages for RPM-based systems, Ubuntu, and Debian, plus official containers documented in packaging/docker/README.md.
  • Covers a Windows Agent in addition to Linux rsyslog, as stated in the description of the experimental rsyslog Assistant.

Who uses it and how

  • Sites running mainstream Linux distributions, where rsyslog is available in distribution repositories and is often pre-installed, making it the default collection path rather than an added component.
  • Production deployments that follow the project's branch guidance: master tracks active development, so production use should prefer the latest tagged release.
  • Environments that need centralized collection combined with remote forwarding, where complex routing decides which messages reach which destination.
  • Teams operating in regions where GitHub access is limited, which the README addresses with alternative mirrors.
  • Windows-side collection alongside Linux infrastructure, since the Windows Agent is covered by the project's own support tooling.

Getting started

The primary route is the distribution package manager, because rsyslog is available in most Linux distribution repositories and is often already installed. When newer versions are needed, the project publishes official builds for RPM-based systems, Ubuntu, and Debian, and official containers under packaging/docker/README.md; building from source requires pkg-config, libestr, and liblogging with the stdlog component for the testbench.

How it compares

The available facts provide no list of paid products that rsyslog is positioned to replace, so no licence, cost-model, or data-ownership contrast can be drawn against named commercial offerings. Among comparable log and event tools, the facts name none directly; the products referenced in the topics, Elasticsearch, Kafka, and MongoDB, appear as destinations that rsyslog writes to rather than as alternatives to it, so it stands alone in this registry.

When to use it — and when not to

A self-hoster takes on the operational surface of the project itself: the configuration model, the module set for each input and output, and, for source builds, the pkg-config, libestr, and liblogging dependencies, with testbench work needing the stdlog component. Teams that want a managed, zero-configuration service should look elsewhere, because rsyslog is deployed through distribution packages, project packages, or containers and configured by the operator. Honest caveats from the facts: the headline throughput figure dates to v7 in December 2013, the repository carries 207 open issues, and the README excerpt supplied here is truncated mid-sentence in the build-environment section, so the documentation depth available at a glance is limited compared with the full documentation site.

project readme (upstream, from github) — read inline

Rsyslog – What Is It?

Rsyslog is a rocket-fast system for log processing pipelines.

It offers high performance, advanced security features, and a modular microkernel-like architecture. Originally a regular syslogd, rsyslog has evolved into a highly versatile logging solution capable of ingesting data from numerous sources, transforming it, and outputting it to a wide variety of destinations.

Rsyslog can deliver over one million messages per second to local destinations under minimal processing (based on v7, Dec 2013). Even with complex routing and remote forwarding, performance remains excellent.

Table of Contents

Getting Rsyslog News

Stay up to date with official rsyslog announcements and community insights:

Official Channels

Maintainer Insights Updates, technical commentary, and behind-the-scenes notes from Rainer Gerhards, rsyslog founder and maintainer:

🤖 Rsyslog Assistant (Experimental AI Help)

Need help with rsyslog configuration or troubleshooting? Try the rsyslog Assistant — your AI-powered support tool built by the rsyslog team.

⚠️ Experimental. May occasionally generate incorrect config examples — always review before applying.

✅ Trained on official docs and changelogs ✅ Covers both Linux rsyslog and Windows Agent ✅ Version-aware and best-practice focused

👉 Try it now: rsyslog.ai

Getting Help (Other Sources)

Installation

Via Distribution Package Managers

Rsyslog is available in most Linux distribution repositories and often is pre-installed.

Project-Provided Packages (Latest Versions)

Distributions may lag behind in packaging the latest rsyslog releases. Official builds for newer versions are available here:

For users in regions where GitHub access is limited, see the Global Accessibility and Collaboration section for alternative mirrors.

Building from Source (click to expand)

See: Build Instructions

Build Environment Requirements
  • pkg-config
  • libestr
  • liblogging (stdlog component, for testbench)

Build support libraries from source if you're working with the latest git master.

Branch Guidance

The master branch tracks active development. For production use, prefer the latest tagged release.

OS-Specific Build Instructions

Refer to the respective section in the original README for required packages on CentOS, Ubuntu, Debian, SUSE, etc.

Development Containers & Testing

Ready-to-use build environments are provided in packaging/docker/dev_env. These images were previously built in the separate rsyslog-docker repository and are now maintained here. See packaging/docker/README.md for details.

Runtime container definitions are in packaging/docker/rsyslog. Run the test suite inside the container with:

make check -j4

Contributing

Rsyslog is a community-driven open-source project. Contributions are welcome and encouraged!

If GitHub access is difficult in your region, please contact us or use one of the mirrors listed below; we will help route your patch for review.

Commit Assistant (recommended): Draft compliant commit messages with rsyslog Commit Assistant and follow rules in CONTRIBUTING.md. Put the substance into the commit message (amend before PR if needed).

AI-Based Code Review (Experimental)

We are currently testing AI-based code review for pull requests. At this time, we use Google Gemini to automatically analyze code and provide comments on new PRs.

  • Reviews are informational only
  • Every contribution is still manually reviewed by human experts
  • The goal is to evaluate how AI can support contributor feedback and code quality assurance

Please report any issues, false positives, or suggestions about the AI review process.

Documentation

Documentation is located in the doc/ directory of this repository. Contributions to the documentation should be made there.

Visit the latest version online:

Project Philosophy

Rsyslog development is driven by real-world use cases, open standards, and an active community. While sponsored primarily by Adiscon, technical decisions are made independently via consensus.

All contributors are welcome — there is no formal membership beyond participation.

Global Accessibility and Collaboration

Rsyslog aims to remain accessible worldwide. Different regions sometimes face network or platform limits, so we provide mirrors to ensure that everyone can obtain the source code and contribute on equal terms.

All pull requests ultimately flow through GitHub, where our CI and review infrastructure run. If you experience access issues but can provide a patch, the rsyslog team will gladly assist in forwarding it to GitHub. Our contribution workflow remains GitHub-based for now because CI and automated testing are tightly integrated there. Always verify releases and tags from the official GitHub repository before production use.

Open source should have no borders. (FR) Le code ouvert ne devrait pas avoir de frontières (ZH) 开源应该没有边界 (JA) オープンソースに国境はない (ES) El código abierto no debe tener fronteras (HI) ओपन सोर्स की कोई सीमाएँ नहीं होनी चाहिए (AR) المصدر المفتوح يجب ألا يكون له حدود

Sponsors

The rsyslog project is proudly supported by organizations that help sustain its continuous development, infrastructure, and innovation. (See also Project Philosophy.)

Prime Sponsor

Adiscon GmbH Adiscon employs core rsyslog developers including Rainer Gerhards and provides ongoing engineering, infrastructure, and CI resources. Through its commercial Windows log management products — such as WinSyslog and Rsyslog Windows Agent — Adiscon helps fund rsyslog’s continued open-source development and ecosystem growth.

Major Sponsor

DigitalOcean Logo

DigitalOcean powers key parts of rsyslog’s CI pipeline, package distribution network, and AI infrastructure as part of their #DOforOpenSource initiative. Their support enables fast, globally available builds and the next generation of AI-assisted rsyslog documentation and tooling.

Additional Acknowledgments

rsyslog also benefits from various open-source infrastructure providers and community initiatives that make modern CI, code hosting, and collaboration possible.

If your organization benefits from rsyslog and would like to contribute to its sustainability, please consider sponsoring or contributing.

Legal Notice (GDPR)

Contributions to rsyslog are stored in git history and publicly distributed.

Frequently asked questions

Is rsyslog free to use?

rsyslog is open source under the LGPL-3.0 licence. There is no licence fee and no seat count — you can self-host it or, where the project offers one, pay a vendor for a managed version instead.

What does rsyslog do?

High-performance log ingestion and ETL engine

What is rsyslog written in?

rsyslog is primarily written in C. Its source is publicly available at https://github.com/rsyslog/rsyslog, and it has 2,345 GitHub stars.