Of course there are other reasons, but they are less important:

• Many distributions also prefer rsyslog to syslog-ng because it’s more powerful and scalable. [1] [2]
• Several people complained against the performance of syslog-ng [3], although the performance of syslog is normally not an issue for individual users.
• Third, I don’t understand why the author of syslog-ng prefers listening on /dev/log as a stream socket (local counterpart of TCP) instead of a datagram one (local counterpart of UDP). (I know it can be changed in the configuration file.) None of the common issues of UDP is present in local datagram sockets: too short length limit; out of order; unreliability. On the contrary, syslog needs unidirectional channels carrying boundary-maintained messages, for which nothing can be more suitable.
• Finally, licensing issues, upstream responsiveness, etc. They are less important for individual users, though.

Sure, syslog-ng also has its advantages. For example, I like the format of its configuration files.

No related posts.