rsyslog

rsyslog is a high-performance syslog daemon for Linux and Unix systems, originally developed by Rainer Gerhards in 2004 and now the default logging daemon on most Linux distributions including RHEL, Ubuntu, Debian, and SUSE. With over 2,200 stars as of 2026, rsyslog achieves throughput exceeding 1 million messages per second. Key features include: multi-threaded architecture with configurable worker thread pools, support for RFC 3164 and RFC 5424 syslog protocols plus RELP for guaranteed delivery, multiple input sources (Unix domain sockets, systemd journal, file tailing, TCP/UDP network syslog, kernel messages), diverse output modules (local files, remote forwarding, MySQL/PostgreSQL/MongoDB databases, Elasticsearch, Apache Kafka, AMQP, Redis, external programs via pipes, and SNMP traps), RainerScript-based filtering and routing for complex conditional logic based on message properties, severity, facility, and regex patterns, template-based message formatting supporting JSON and structured data, disk-assisted memory queues for guaranteed delivery during high load, TLS encryption via GnuTLS or OpenSSL, and rate limiting to prevent log flooding. Licensed under GPL-3.0.