rsyslog helps you collect, transform, and route event data reliably at scale. Built for speed, flexibility, and control in modern Linux and container environments.

rsyslog is widely used as the default logging daemon on Linux systems and scales from embedded environments to large enterprise deployments. Its modular design enables you to collect, transform, …

This section is the reference manual for configuring rsyslog. It covers all major configuration concepts, modules, and directives needed to build robust logging infrastructures — from simple setups to …

Support: rsyslog Assistant | GitHub Discussions | GitHub Issues: rsyslog source project Contributing: Source & docs: rsyslog source project © 2008–2025 Rainer Gerhards and others. Licensed under …

This page introduces the core concepts and structure of rsyslog configuration. Rsyslog is best thought of as a highly extensible logging and event processing framework.

It also contains some more in-depth description of what rsyslog does and why. It is recommended to at least briefly read through this part before going to more complex scenarios.

Support: rsyslog Assistant | GitHub Discussions | GitHub Issues: rsyslog source project Contributing: Source & docs: rsyslog source project © 2008–2025 Rainer Gerhards and others. Licensed under …

Every output in rsyslog, from files to Elasticsearch to remote syslog, relies on templates. If no explicit template is bound, rsyslog uses built-in defaults compatible with classic syslog.

Every regular rsyslog release is tagged 8.yymm.0. The constant 8 marks the current major series, yymm tells you the year and month of the build, and the trailing digit starts at 0 and only increments when a …

Jul 3, 2008 · Rsyslog’s TLS authentication can be used very flexible and thus supports a wide range of security policies. This section tries to give some advise on a scenario that works well for many …