# rsyslog

Important

Confirm Your Source: Use the Official Documentation

The rsyslog project is widely used, and as a result, you may find unofficial copies of our documentation on third-party websites, including outdated versions on platforms like readthedocs.io.

To ensure your configuration is secure, performant, and uses modern RainerScript syntax, please rely exclusively on the official documentation hosted at www.rsyslog.com/doc This is the only source actively maintained by the rsyslog development team.

rsyslog is a high-performance, modular logging framework designed for both traditional syslog workloads and modern log processing pipelines. It supports flexible routing, advanced filtering, structured logging, and integrations with modern observability tools such as Elasticsearch, Kafka, and cloud-based systems.

rsyslog is widely used as the default logging daemon on Linux systems and scales from embedded environments to large enterprise deployments. Its modular design enables you to collect, transform, and reliably deliver logs to a wide variety of destinations.

Start Here: - Getting Started - Configuration Basics - Troubleshooting - Tutorials

- About rsyslog
  - AI-First (Human-Controlled): Principles and Practice
  - rsyslog Release Numbering Scheme
  - History of rsyslog
  - Origins of rsyslog (1983–2003)
- Getting Started with rsyslog
  - Beginner Tutorials
  - AI Assistants
  - Installing rsyslog
  - Basic Configuration
  - Understanding the Default Configuration
  - Forwarding Logs
  - Next Steps
  - Understanding rsyslog version numbers
- Configuration
  - Basic Structure
  - Output Modules
  - Input Modules
  - Parser Modules
  - Message Modification Modules
  - String Generator Modules
  - Library Modules
  - Templates
  - rsyslog Properties
  - The Property Replacer
  - Filter Conditions
  - RainerScript
  - Actions
  - Input
  - Parser
  - timezone
  - Examples
  - Legacy Configuration Directives
  - rsyslog statistic counter
  - Modules
  - Output Channels
  - Dropping privileges in rsyslog
  - Notes on IPv6 Handling in Rsyslog
  - libgcrypt Log Crypto Provider (gcry)
  - libossl Log Crypto Provider (ossl)
  - Dynamic Stats
  - Lookup Tables
  - Percentile Stats
  - Converting older formats to `advanced`
  - Configuration Formats
  - sysklogd format
  - Additional Resources
  - Compatibility Note
- FAQ
  - FAQ: some general topics often asked
  - What is the difference between the main_queue and a queue with a ruleset tied to an input?
  - FAQ: Encrypting MySQL Traffic with ommysql Plugin
  - FAQ: Troubleshooting UDP Packet Loss
  - Common Configuration Mistakes and Misunderstandings
  - Why do I see gibberish when connecting with TLS?
  - FAQ: Can rsyslog act as an ETL tool?
  - FAQ: Sending Logs from rsyslog to Vespa.ai
  - Does rsyslog run under Windows?
- Tutorials
  - Encrypting Syslog Traffic with TLS (SSL)
  - Encrypting Syslog Traffic with TLS (SSL) [short version]
  - Writing syslog messages to MariaDB, MySQL, PostgreSQL or any other supported Database
  - Handling a massive syslog database insert rate with Rsyslog
  - Reliable Forwarding of syslog Messages with Rsyslog
  - Recording the Priority of Syslog Messages
  - Failover Syslog Server
  - Log rotation with rsyslog
  - GELF forwarding in rsyslog
  - Log Sampling
  - Random sampling
  - Hash-based Sampling
- Troubleshooting
  - Typical Problems
  - General Procedure
- Concepts
  - Overview
  - Core concepts
  - How to use this section
- Development
  - rsyslog coding practices reference
  - The rsyslog config data model
  - Objects
  - Debugging
  - Action Threads and Queue Engine (Developer-Oriented)
  - rsyslog code style
  - Writing Rsyslog Output Plugins
  - The rsyslog queue object
  - writing rsyslog tests
  - Documentation Reference Section Structure Guidelines
  - Documentation Style Guide
  - Developer Overview: rsyslog Engine
  - Generic design of a syslogd
  - Internal tooling
- Reference
  - History of rsyslog
  - Rsyslog Containers
  - Installation
  - Historical Documents
  - This Page Has Moved
  - Licensing
  - How you can Help
  - Community Resources
  - RSyslog - Features
  - Proposals
  - Rsyslog Whitepapers

## Community and Sponsors

See the Sponsor’s Page for details on project sponsors and how to support ongoing development.

Want to help? See How you can Help.

## Contributing to Documentation

This documentation is hosted on GitHub. Use the “Edit in GitHub” button on any page to suggest improvements.

Support: rsyslog Assistant | GitHub Discussions | GitHub Issues: rsyslog source project

Contributing: Source & docs: rsyslog source project

© 2008–2025 Rainer Gerhards and others. Licensed under the Apache License 2.0.