Migrating from syslog-ng Premium Edition to AxoSyslog CV

The original creator and maintainers of syslog-ng built the Axoflow Platform on top of AxoSyslog, an actively developed syslog-ng fork. The features of syslog-ng PE (TLS with X.509, disk buffering, flow control, reliable transport) carry over directly to AxoSyslog CV.

AxoSyslog CV uses the same configuration files, disk queues, credentials, services, and binaries, so you can upgrade your syslog-ng deployment to AxoSyslog CV in place in a few minutes. After the upgrade, AxoSyslog continues processing your messages right where syslog-ng PE left off.

AxoSyslog is a drop-in replacement for PE, so your team doesn't have to learn a new configuration syntax, or think about how to restart AxoSyslog, because it uses the same configuration syntax as what they are used to with syslog-ng. Syslog-ng users will recognize the configuration of AxoSyslog immediately and enjoy the benefit of an observability layer on top of their syslog collection layer.

So switching from syslog-ng PE to AxoSyslog CV is like an upgrade, not a full-blown migration project. The upgrade can be performed in-place. You can roll out AxoSyslog to your syslog-ng PE hosts at your own pace, it's not necessary to upgrade every host all at once.

AxoSyslog CV is a commercially-supported drop-in replacement for syslog-ng Premium Edition. In addition to AxoSyslog CV, AxoSyslog CV licenses also include:

• AxoEdge, an end-point log collector agent for Microsoft Windows and Linux hosts to replace syslog-ng Agent for Windows.
• AxoConsole, a web UI for watching metrics, analytics, and alerts about your AxoSyslog CV and AxoEdge deployments. You can also manage and configure AxoEdge deployments from the AxoConsole. (Note that you can manage both AxoSyslog CV and AxoEdge manually using configuration files — using AxoConsole is entirely optional.)

1. Deploy AxoSyslog CV on your PE hosts. You can deploy AxoSyslog CV by downloading and running an installer which includes all required dependencies. The installation takes only a few minutes, after that AxoSyslog CV continues processing your logs using the configuration files of syslog-ng PE. If your PE deployment includes a Windows Event Collector, AxoSyslog CV automatically converts its configuration to use with its own Windows Event Collector implementation.
2. Check the destinations of the host and verify that logs are getting there.
3. (Optional) If you already have an AxoConsole deployment and want to see the metrics of AxoSyslog CV in AxoConsole, deploy axolet on the AxoSyslog CV host. AxoSyslog CV starts sending metrics about the host to AxoConsole, and the host shows up on the Provisioning page in AxoConsole. Register it to add the host to the Topology.
4. (Optional) To get more detailed metrics about the traffic flow, follow the instrumentation guide to instrument your AxoSyslog CV configuration.

If you run syslog-ng Agent for Windows to collect event log data from your Microsoft Windows hosts, deploy AxoEdge for Windows on these hosts. Deploying AxoEdge is simply running a one-liner in PowerShell. The installer automatically converts the syslog-ng Agent configuration to AxoEdge configuration.

In addition to Event Logs, AxoEdge can also collect logs from Event Tracing for Windows (ETW).

If you run syslog-ng PE on a host only to collect data locally (from files or journald), consider replacing it with AxoEdge. You can either manage AxoEdge manually on each host using configuration files (like syslog-ng PE), or centrally from AxoConsole using collection rules and data forwarding rules.

• Collection rules describe what AxoEdge collects on a labeled set of hosts.
• Data forwarding rules describe where the collected data goes (typically to an AxoSyslog OpenTelemetry source).

Most of the conditional logic PE configurations accumulate over the years — multi-step transformations, custom field derivations, and conditional rewrites that depend on cross-field context — can be vastly simplified using FilterX blocks.