AxoSyslog Year 2: Progress Comparison vs. syslog-ng

It's become a tradition to look back and compare how AxoSyslog and its predecessor, syslog-ng™, evolved over the past twelve months. For the period between 18 May 2025 and 18 May 2026, the gap in development pace that we noted last year hasn't closed — if anything, it widened.

In one year, AxoSyslog shipped 14 feature releases and 3 patch releases — 17 in total. Over the exact same window, syslog-ng shipped 3 feature releases and 2 patch releases — 5 in total (since 4.0.12 arrived on June 16, we’ll cover it next year). That's roughly one AxoSyslog feature release every 3–4 weeks, versus one syslog-ng feature release every four months.

	AxoSyslog	syslog-ng
Minor (feature) releases	14 (4.12→4.25)	3 (4.9.0, 4.10.0, 4.11.0)
Patch releases	3 (4.18.1, 4.19.1, 4.20.1)	2 (4.10.1, 4.10.2)
Total	17	5

Code-wise, the changes during this period brought:

	AxoSyslog	syslog-ng
Pull requests	409	215
Commits	2116	967
Files changed	2742 files changed, 68871 insertions(+), 39117 deletions(-)	995 files changed, 26368 insertions(+), 33640 deletions(-)

Here’s a quick summary about the release highlights.

syslog-ng

Three feature releases and two patch releases, shipping:

stats-exporter() source — serve statistics directly to HTTP/Prometheus scrapers without a separate destination.
syslog() RFC6587 auto-detection via transport(auto).
inotify-based file change detection for wildcard-file(), and exclude-pattern() for wildcard-file(), cutting CPU usage on Linux.
google-pubsub-grpc() destination
azure-monitor() destination
response-action() for gRPC destinations
$PEERIP/$PEERPORT macros
Cisco NXOS 9.3 parsing
New S3 options
Filesize-based logrotation
a blank filter
kafka-source() — fetch messages directly from Apache Kafka.
Generic OAuth2 / cloud-auth support, extended to gRPC destinations.
extended-key-usage-verify() TLS option for network()/syslog().
auto follow-method for file sources
Elasticsearch/OpenSearch data-stream support via SCL

The GitHub statistics show that the development of syslog-ng became largely (in 87%) a one-man show. Backports from AxoSyslog have basically ceased after AxoSyslog switched to full GPL licensing.

AxoSyslog

Fourteen feature releases (4.12–4.25) plus three patch releases:

Relicensed to GPL-3.0-or-later (4.12)

A new wave of FilterX operators and improvements:
- Arithmetic operators, the in list-membership operator, and the strcasecmp case-insensitive string comparison function (4.12).
- Protobuf, XML, Windows EventLog XML, CEF, and LEEF formatting functions for FilterX (4.13)
- str_replace, string slicing (..) and negative indexing, and the :?? Create-if-non-null operator for FilterX (4.15–4.17).
- parse_csv quote-pairs and parse_kv stray-word handling (4.14).
- dict_to_pairs and a length-limited includes() (4.19).
- format_syslog_5424 (4.21)
- Dictionary-key search for FilterX membership operators (4.22).
- format_isodate, move (4.23)
- FilterX timezone functions (4.24)
- Cryptographic digests (md5/sha1/sha256/sha512/digest), base64/URL/hex encoding (4.25)
- UTF-8 validation and sanitization (4.25)
- glob_match, uuid (4.25)
- ip()/subnet() FilterX types with CIDR membership (4.25)
ClickHouse destination improvements
Cisco Nexus NX-OS log parsing (4.14)
A client-port option for loggen (4.14).
HTTP and http-based destination improvements
- dynamic http() destination headers via macros (4.18)
- Smarter content-compression()
parallelize() with batch-size() (4.17).
keep-alive() for OpenTelemetry (OTLP) sources (4.20)
New s3() object-key suffix and worker-partition options (4.20).
NUL-terminated syslog framing (4.21)
worker-partition autoscaling (4.21)
extended-key-usage-verify() TLS option
up to 50% lower disk-buffer queue memory usage (4.23).
The syslog-ng --metrics-registry command-line option
the [batch-idle-timeout() option across ~18 destinations](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-http-nonjava/reference-destination-http-nonjava/)
failover() for the network load balancer (4.24)
transport("proxied-udp") for HAProxy Proxy Protocol
v2 (4.25)

These features were developed by several members of the Axoflow team.

The bottom line

Over the past year, AxoSyslog had releases every 2-4 weeks to deliver bugfixes and security fixes more rapidly. AxoSyslog shipped six feature releases while syslog-ng shipped one. The AxoSyslog team continued to push the FilterX data-processing engine forward release after release (new operators, functions for encoding, formatting, timezone handling, and more), while also improving performance and scaling.

If you need help with syslog-ng or AxoSyslog, don’t forget that you can reach out to us and talk to myself and our devs using our Discord server, or if you need help in troubleshooting data loss or scaling issues, book a free interactive consultation session.