Is rsyslog compatible with syslog-ng?

[reinier-ZA]

Hello community!

I am doing a project where the organisation uses syslog-ng for the central remote logging servers and this will surely not change.

The application suite that I am developing on, is using Red Hat Enterprise Linux 8, which will surely also not change.

From my understanding, RHEL 8 ships standard with rsyslog and if I want to use syslog-ng, it is necessary to install it from either the EPEL repositories or the "suplementary" repository.

However, I am working on private internal network without internet access and the internal RHEL update server does not provide these repositories.

So my main question is how do I get my application logs on RHEL 8 to the remote syslog-ng server?

I suppose my options are as follows:

1. try to somehow get syslog-ng installed internally on my client (cumbersome option)
2. perhaps rsyslog is already compatible with syslog-ng, so I can simply log there? (wishful option)
3. convert rsyslog logs to syslog-ng before pushing it to the the log server (undesirable option)

Could you guys please provide some advice?

Thanks in advance!

[czanik]

Yes, it is, using both the legacy rfc3164 and the new rfc5424 syslog protocols.

I do not know much about rsyslog configuration, but once upon a time I did some research: https://www.syslog-ng.com/community/b/blog/posts/using-rfc5424-syslog-protocol-plain-tcp-rsyslog-syslog-ng

So, rfc5424 works both with framing and without it, but needs to be configured differently on the syslog-ng side.

[reinier-ZA]

Thanks a lot for your quick reply, this is indeed good news to know that syslog-ng and rsyslog are indeed compatible.

Once I figure out the configuration, I will post it here.