Compare / Syslog

Free Syslog Server: rsyslog, syslog-ng, or Hosted?

Choose rsyslog or syslog-ng for a free, self-hosted Syslog receiver when you can operate its configuration, queues, storage, search, and upgrades. Consider Fluxtail when you want a hosted TLS Syslog receiver with named streams, Live Tail, and field-based filters. Fluxtail is available by request; access, limits, retention, and pricing are confirmed before setup. Windows Event Log is separate from Syslog and needs a compatible forwarding path.

Free syslog server Open source syslog server rsyslog syslog-ng

Join the waitlist View pricing

Free tools are strong at collection

rsyslog and syslog-ng-style tools are practical choices for receiving, filtering, forwarding, and routing syslog traffic.

Self-managed means operating the path

You maintain config, queues, forwarding targets, reloads, upgrades, and the place people use to read the resulting logs.

Fluxtail provides a hosted TLS receiver

Fluxtail is available by request when you want a hosted TLS Syslog receiver connected to named streams, Live Tail, and field-based filters. Access, limits, retention, and pricing are confirmed before setup.

Windows Event Log is not syslog

Event Viewer and Windows Event Forwarding work with Windows Event Log records. Sending those records to a syslog receiver requires a compatible Windows agent or gateway.

Examples

A free syslog server still needs a destination and checks

The examples below show the practical shape of the decision: forwarding config, a known test line, and the row you want to read after the message arrives.

rsyslog TLS forwarding

config

1global(DefaultNetstreamDriverCAFile="/etc/ssl/certs/ca-certificates.crt")
2 
3action(
4  type="omfwd"
5  target="YOUR_POOL_HOSTNAME"
6  port="YOUR_ASSIGNED_PORT"
7  protocol="tcp"
8  StreamDriver="gtls"
9  StreamDriverMode="1"
10  StreamDriverAuthMode="x509/name"
11  StreamDriverPermittedPeers="YOUR_POOL_HOSTNAME"
12  TCP_Framing="octet-counted"
13  template="RSYSLOG_SyslogProtocol23Format"
14  action.resumeRetryCount="-1"
15  queue.type="LinkedList"
16  queue.filename="fluxtail"
17  queue.saveOnShutdown="on"
18)

Production accepts TLS TCP, not UDP or plain TCP. Copy the exact active receiver hostname and assigned port, and allow the sender's public IPv4 or CIDR in its source rules.

Validate TLS without disabling verification

bash

1openssl s_client \
2  -connect YOUR_POOL_HOSTNAME:YOUR_ASSIGNED_PORT \
3  -servername YOUR_POOL_HOSTNAME \
4  -verify_hostname YOUR_POOL_HOSTNAME

Keep public CA and hostname verification enabled.

Known sender test

bash

1logger -p user.info "syslog receiver check $(date -Iseconds)"

Send a small known line before declaring the receiver ready.

Readable received row

output

2026-04-24T14:18:22Z INFO infra/syslog edge-01 logger syslog receiver check 2026-04-24T14:18:22-04:00

A useful reader keeps timestamp, severity, stream, host, program, and message visible without opening several tools.

Option	Best fit	Windows Event Log fit	What you operate or pay for
rsyslog	Free self-hosted syslog receiving, filtering, queuing, and forwarding on Linux	Not a native Windows Event Log collector	Daemon configuration, TLS, queues, monitoring, upgrades, and the storage or search destination
syslog-ng OSE	Free self-hosted syslog sources, filters, routes, and network destinations	Not a native Windows Event Log collector	Routing configuration, TLS, buffering, monitoring, upgrades, and the storage or search destination
Windows Event Forwarding / Windows Event Collector	Windows-native collection of selected Event Log records over WS-Management	Collects Windows Event Log records; it is not a syslog server	Subscriptions, collector hosts, access policy, and Windows event-log storage
Fluxtail	Hosted TLS syslog receiving with streams, live tail, and field-based filters	Not a native WEF/WEC endpoint; Windows events need a compatible forwarder or gateway	Sender configuration and source IPv4 or CIDR rules; Fluxtail access, limits, retention, and pricing are confirmed before setup

Use cases

When a free syslog server makes sense

Free syslog tools are a practical choice when the job is receiving, filtering, or forwarding syslog from sources you already operate.

01

Linux hosts and VMs

Use rsyslog when Linux machines already emit local syslog and you want a familiar daemon to forward those messages to a central destination.

Fluxtail Syslog setup Official rsyslog omfwd documentation

02

Network devices and appliances

Use rsyslog or syslog-ng-style tooling when routers, firewalls, NAS devices, hypervisors, or older services send standard syslog traffic.

Official syslog-ng documentation

03

Windows Event Log is a separate source

Windows Event Log is not a native syslog feed. Use a Windows-capable collector or forwarding path when Windows events must reach a syslog receiver, and verify the event fields that survive the conversion.

Microsoft Windows Event Collector documentation

04

Central reading and analysis

Use Fluxtail as the destination when Syslog messages need a hosted TLS receiver, named streams, Live Tail, and field-based filters. Fluxtail is available by request, with access and pricing confirmed before setup.

Comparison checklist

What to compare before choosing

Compare the full path from sender to receiver to the screen where the log line is read.

01

Receiving and forwarding

Check whether the tool cleanly receives the protocols you use, forwards to the destination you want, and has visible queue behavior when the destination is unavailable or slow.

02

Config and maintenance

Self-managed syslog means owning config files, reload behavior, package upgrades, queue settings, service monitoring, and the operational notes your future self will need.

03

Storage and reading

Check where logs are stored, how long they stay available, which fields are searchable, and whether host, app, severity, stream, and message stay visible.

04

Other log sources

If HTTP application logs, Kubernetes logs, OTLP, GELF, Fluent Bit, or rsyslog/syslog-ng traffic all need one destination, make sure the syslog choice does not isolate that data.

Self-managed checklist

What a free syslog setup still asks you to operate

Free is not the same as zero-maintenance. The daemon can be free while the surrounding operational work is still yours.

01

Keep the sender healthy

Verify that the daemon is running, the destination is reachable, and service logs do not show repeated connection or queue errors.

Basic rsyslog checks

bash

1sudo systemctl status rsyslog
2sudo ss -tunap | grep rsyslog
3sudo journalctl -u rsyslog -n 50

These checks are simple, but they still belong to the cost of running a self-managed free syslog server.

02

Test one known message end to end

Use a message you can recognize, then confirm the same timestamp, host, program, severity, and text appear in the destination reader.

Known test line from a sender

bash

1logger -p user.info "fluxtail syslog check $(date -Iseconds)"

What the reader still needs to show clearly

output

2026-04-24T14:18:22Z INFO  infra/syslog edge-01 logger fluxtail syslog check 2026-04-24T14:18:22-04:00

This test separates successful forwarding from useful log reading.

Choosing a path

When to stay self-managed and when to consider Fluxtail

A free syslog server is a good choice when you want to operate collection and routing yourself. Consider Fluxtail when the receiver and shared log-reading tools should be hosted; access and pricing are confirmed before setup.

01

Stay free when the job is just forwarding

If you mainly need a reliable self-managed syslog destination or hop, rsyslog or syslog-ng OSE can be a strong fit.

02

Consider Fluxtail when reading and analysis matter

Consider Fluxtail when the destination needs a hosted TLS receiver, named streams, Live Tail, and field-based filters instead of only receiving messages. Access and pricing are confirmed before setup.

03

Consolidate when other log sources arrive

If app logs, containers, OTLP, GELF, HTTP, or collector-fed logs should share the same account, Fluxtail keeps syslog from becoming a separate island.

FAQ

Questions readers usually ask next

Short answers to the follow-on questions this page tends to raise.

FAQ What is a free syslog server good for?

A free syslog server is good for receiving, routing, filtering, and forwarding syslog messages when you are comfortable operating the daemon, config, queues, and destination yourself.

FAQ Is rsyslog enough for central logging?

rsyslog can be enough for self-managed forwarding and collection. You still need to decide where logs are stored, searched, read, alerted on, and shared.

FAQ Can syslog-ng forward logs to Fluxtail?

Yes. Configure a syslog-ng TLS network destination with the exact hostname and assigned port shown by an active Fluxtail receiver. The sender's public IPv4 address must match an allowed IPv4 or CIDR source rule. Fluxtail is available by request, so confirm access before configuring the sender.

FAQ Can a free syslog server collect Windows Event Log directly?

Windows Event Log is not syslog by default. A Windows-capable collector or forwarding layer must read those events and send them to the chosen destination in a supported format.

Use Fluxtail as a syslog server for centralized syslog collection, live tail, filters, and syslog analysis.

Set up rsyslog centralized logging with syslog forwarding, omfwd, queues, test messages, and readable Linux syslog streams in Fluxtail.

Set up syslog-ng centralized logging with source, filter, destination, and log blocks. Forward Linux syslog to Fluxtail for live tail and search.

What a syslog analyzer should help you do: filter syslog logs by host, app, severity, and time, then summarize the selected rows.

Centralized log management with readable live tail, clear streams, and straightforward ingest.

Learn how log aggregation works across apps, hosts, syslog, containers, Kubernetes, OTLP, GELF, and collectors.

Watch production logs in real time with a live log viewer for readable streams, live tail, filters, and diagnostics.

Request access to Fluxtail and review availability, plan limits, retention, and pricing with Fluxtail Engineering.

Next step

Plan the first real log source

Choose one real source and join the waitlist to request access.

Choose one real source for Fluxtail.

When access is available, create a receiver, send one source, and inspect the first stream.

Join the waitlist View pricing

Free Syslog Server: rsyslog, syslog-ng, or Hosted?

A free syslog server still needs a destination and checks

When a free syslog server makes sense

Linux hosts and VMs

Network devices and appliances

Windows Event Log is a separate source

Central reading and analysis

What to compare before choosing

Receiving and forwarding

Config and maintenance

Storage and reading

Other log sources

What a free syslog setup still asks you to operate

Keep the sender healthy

Test one known message end to end

When to stay self-managed and when to consider Fluxtail

Stay free when the job is just forwarding

Consider Fluxtail when reading and analysis matter

Consolidate when other log sources arrive

Questions readers usually ask next

Related pages

Plan the first real log source