syslog-ng VS graylog

Syslog-ng can feed splunk directly via HEC without having to use heavy forwarders. Earlier you had to hand configure it via the http () destination, v4.2 added this via a separate destination driver. https://github.com/syslog-ng/syslog-ng/releases/tag/syslog-ng-4.2.0

ports: syslog-ng 4.1.1[6]

Syslog-ng seems a bit weird about open/close source. They have a github but it seems like all the documentation is seemingly all over the place & it's not obvious to find what the limitations of open source version are.

What we do internally is use [syslog-ng](https://github.com/syslog-ng/syslog-ng) to read the journald socket and push to a remote and into Kafka. I think journald works well as a structured logging tool, but it's certainly deficient in other ways

We're using syslog-ng in my apprenticeship, it works just fine, interfacing with a in-prem Prometheus/Elasticsearch

[12] https://github.com/syslog-ng/syslog-ng/releases/tag/syslog-ng-3.31.1

Graylog: An open source log management platform that provides real-time visibility into security events and facilitates incident response.

https://www.graylog.org/ but might be overkill.

Looks like the fix for this went in on March 28 and this should have been included in the April bugfix release 5.0.6

Sure! I use the Open Source of Graylog to search and build reports from the data. It sits on its own Droplet

Check out Graylog - https://www.graylog.org/ Graylog stores everything in elasticssearch, so you gan also use it as a datasource in Grafana.

Graylog

I use this to monitor my reverse proxy (SWAG) and fail2ban logs in conjunction. It's not as streamlined as GoAccess, GrayLog, Grafana, etc . . . but it is very personal. I divide all my connections into three buckets: Home, Outside, and Known Devices; and fail2ban statistics are layered against the all connections.

Graylog is an open-source centralized log management and analytics tool. It collects, enhances, correlates, searches, and visualizes all your log data in one location to uncover patterns and trends for application and IT infrastructure.