---
title: "syslog-ng"
url: "https://axoflow.com/docs/axoflow/0.86/data-sources/appliances/syslog-ng/"
last_modified: "2025-08-12T13:23:20+02:00"
---

> For the complete documentation index, see [llms.txt](https://axoflow.com/docs/axoflow/0.86/llms.txt).

# syslog-ng

By default, Axoflow treats syslog-ng sources as a [generic syslog source](https://axoflow.com/docs/axoflow/0.86/data-sources/generic/index.md).

- The easiest way to send data from syslog-ng to Axoflow is to configure it to send data to an AxoRouter instance using the syslog protocol.
- If you’re using syslog-ng Open Source Edition version 4.4 or newer, use the `syslog-ng-otlp()` driver to send data to AxoRouter using the OpenTelemetry Protocol.

Note that even if syslog-ng is acting as a relay (receiving data from other clients and forwarding them to AxoRouter), on the **Topology** page it will be displayed as a data source.

## Prerequisites

- You have administrative access to the device running syslog-ng.
- The date, time, and time zone are correctly set on the appliance.
- You have an [AxoRouter deployed and configured](https://axoflow.com/docs/axoflow/0.86/provisioning/axorouter/index.md) with a [Syslog connector](https://axoflow.com/docs/axoflow/0.86/data-sources/syslog/index.md) that has parsing and classification enabled (by default, every AxoRouter has such connectors). This device is going to receive the data from the source.
- You know the IP address the AxoRouter. To find it:

  1. Open the AxoConsole.
  2. Select the **Routers** or the **Topology** page.
  3. Select on AxoRouter instance that is going to receive the logs.
  4. Check the **Networks > Address** field.

> **Note:**
> To receive more detailed metrics about the data processed by syslog-ng, consider [onboarding the host into Axoflow and instrumenting its configuration](https://axoflow.com/docs/axoflow/0.86/provisioning/syslog-ng/index.md).