AxoSyslog documentation

AxoSyslog is a scalable security data processor by Axoflow.

AxoSyslog started as a fork, branched after syslog-ng™ v4.7.1 with the following focus:

  • Cloud native:
    • Provides containers, Helm charts, Kubernetes integration, ARM support
  • Parsing and transformation tailored for security data (filterx, app-parser, app-transform)
  • Performance (eBPF support, alternative memory allocator, and so on),

AxoSyslog (created by the original creators of syslog-ng):

  • is a drop in replacement for syslog-ng,
  • keeps using the same license and development practices.

If you want to try running syslog-ng in a container, or use it as a log collector in Kubernetes, try AxoSyslog! See Install AxoSyslog to get started.


Any feedback is greatly appreciated, especially on what else this document should cover. General comments, errors found in the text, and any suggestions about how to improve the documentation are also welcome as GitHub issues, or on the Axoflow Discord server.


In case you need help with any of the AxoSyslog projects, or directly with syslog-ng, you have several ways to contact us:

We also provide consulting and professional services for logging and observability related projects. Contact us if you need our help!

Documentation license

This documentation is originally based on the syslog-ng Open Source Edition documentation for version 3.38 and is used in compliance with the terms of The syslog-ng Open Source Edition Documentation License. We are continuously working on it to keep it up-to-date with the latest released version of AxoSyslog (currently 4.7).

In compliance with the above license, syslog-ng is used only to refer to the binary of the application, or in filenames, pathnames, and similar technical terms. For all other references, we use the AxoSyslog name. Syslog-ng is a trademark of One Identity.

New files and modifications compared to the syslog-ng Open Source Edition documentation are under the copyright of Axoflow, and licensed under Apache License 2.0, except for using the Axoflow and AxoSyslog trademarks.

The Axoflow and AxoSyslog trademarks and logos are trademarks of Axoflow Inc. All other trademarks are property of their respective owners.

This documentation is maintained by Axoflow, and continually updated for new releases.


We would like to express our gratitude to everyone involved with the project, including the syslog-ng developers, advocates, and documentation maintainers who worked at BalaBit or are still working at One Identity, or who helped the project as external contributors, users, or as part of the community.

Last modified June 7, 2024: Tagline and minor intro updates (50c37b7)