AxoSyslog is binary compatible with syslog-ng™: you can use it as a drop-in replacement that uses the same service names and configuration files, making the upgrade completely a non-issue.

Six months have passed since we decided to make AxoSyslog a full-blown syslog-ngTM fork, so we thought it might be worth checking how the development of the two projects are going. (You might remember that Axoflow was the biggest contributor to syslog-ng in 2023.) 

For reference, statistics refer to the period between 17-05-2024 and 14-11-2024, and were calculated using the main branches of the projects.

Day 182

AxoSyslog statistics

As you can see in the following image, 97% of the AxoSyslog commits are coming from Axoflow employees, which is not all that surprising. We had a few community contributions (many thanks for all of you!), but not that many, since technically we’re a new project. We’ve also ported a few bugfixes from the syslog-ng project.

The next figure shows the overall activity in the AxoSyslog repository for the last 18 years. Obviously, this covers 6 months of AxoSyslog development, and the 17 and half years of activity of the syslog-ng repository. This figure gives two important insights:

• Development of syslog-ng was on its peak in 2018-19, and has significantly slowed after 2019, hitting its low point in 2021.
• Owing to Axoflow’s contribution in 2023, and our work in 2024, development has climbed back to its previous high point.

Syslog-ng statistics

As you can see, us starting to work on AxoSyslog has actually bolstered activity in the syslog-ng project, but things seem to have quieted down a bit through the last months.

Looking into the commits, you can see that about 22% of the syslog-ng commits are coming from Axoflow employees, these are mostly backports of new drivers and bugfixes from the AxoSyslog repo. (syslog-ng and AxoSyslog backport all user-visible bugfixes from each other.)

While 22% doesn’t seem too much, checking the total amount of code changes (for lack of better metric) shows significant difference in the activities of the two projects:

Feature comparison

Feature-wise, the following main changes happened in the projects.

New features in syslog-ng

• New documentation site
• Wildcard file source fine-tuning
• Numerical severity filter
• Proxy protocol for the syslog() and network() source drivers

syslog-ng features backported from AxoSyslog

• Amazon S3 destination
• elasticsearch-datastream() destination
• Features for gRPC-based destinations (opentelemetry, loki, bigquery): headers, compression, etc.
• no-piggyback-errors for syslog-parser
• tls(): expose the key fingerprint of the peer

New features in AxoSyslog

• FilterX – a replacement for syslog-ng filter statements, parsers, and rewrite rules. It has a syntax and rich set of operators similar to popular scripting languages that allows you to filter, parse, manipulate, and rewrite variables and complex data structures.
• Log tapping into the outputs and internal logs
• Amazon S3 destination
• elasticsearch-datastream() destination
• ClickHouse destination
• Features for gRPC-based destinations (opentelemetry, loki, bigquery): headers, compression, dynamic header values, etc.

Summary

After 2023 busy with work on syslog-ng, we haven’t slowed down, hitting a record high in 2024 with AxoSyslog. We’ve published two major releases (see the 4.8 and 4.9 release announcements for details), including FilterX, which is probably the biggest change in recent years. So, I think it’s safe to say that AxoSyslog development hasn’t stalled, and we very much intend to keep it that way.

What’s to come

We have many plans to extend FilterX with new parsers to make it even more versatile. Also, building on the AxoSyslog gRPC framework used in the Loki, BigQuery, ClickHouse, or OpenTelemetry drivers, we want to support more destinations, like Google Pub/Sub. Stay tuned, and follow our blog or the AxoSyslog repository for updates!

Trademark attribution

syslog-ng™ is the trademark of One Identity LLC