rsyslog

rsyslog receives log messages, filters and transforms them, and writes them somewhere — local files, a remote collector, a database, or a SIEM. It is the default syslog implementation on most distributions and coexists with the systemd journal, usually reading from it and forwarding onward.

Why forwarding is the point

A log stored only on the host it describes has one fatal property: anyone who compromises the host can delete it. The record of an intrusion sits on the machine the intruder controls.

Central collection fixes this and buys three more things. Correlation across hosts becomes possible, which is the only way to see patterns no single machine can — the basis of what Wazuh does. Logs survive the host, so a machine that is rebuilt or destroyed still has its history. And retention becomes one policy rather than per-host disk management.

For audit records specifically this is not optional. An audit trail that can be deleted by whoever triggered it is not a trail.

What to get right

Use TCP with TLS, not the UDP default. Plain UDP syslog drops messages silently under load and is trivially forgeable — anyone who can reach the collector can inject entries. For anything security-relevant this matters, and the default is the insecure option.

Configure disk-assisted queuing. If the collector is unreachable, rsyslog can buffer to disk and forward when it returns. Without it, messages are lost during exactly the network problems most worth having logs about. Cap the queue so a long outage does not fill the disk.

Rate limiting is on by default and will silently drop messages from a chatty service. Discovering that logs are incomplete because of an invisible rate limit is a memorable afternoon.

Its awkward position

rsyslog’s configuration syntax has three generations layered on each other — legacy sysklogd format, a middle syntax, and RainerScript — and examples online mix them freely. Writing new configuration in RainerScript consistently is worth the discipline.

Its role has also narrowed. systemd-journald handles local collection, and structured logging pipelines increasingly go directly to a collector. rsyslog remains the reliable, boring way to get records off a host, which is a job that still needs doing.

See also: systemd, auditd, Wazuh, chrony for timestamps that agree, and Checkmk.