One Identity syslog-ng
syslog-ng is the reliable, vendor-neutral log pipe — collect, parse, filter and route logs from the whole estate, cut SIEM ingest cost, and never lose a log to an outage.
Buy through TechBag
Same software. Better outcome — at a lower cost.
How it’s rated
Full scoreboard ↓Quick answer
The One Identity platform family
This page covers syslog-ng — log management. The rest of the platform:
Quick facts
30-second orientation- Product
- syslog-ng — log management & collection
- Vendor
- One Identity (a Quest Software company · via Balabit, 2018)
- The category
- Log Management
- The job
- Collect, parse, filter, route logs across the estate
- The reliability
- Disk-buffering — no log lost; very high throughput
- The SIEM value
- Reduce & transform logs → lower SIEM TCO
- Editions
- Open source · Premium Edition · Store Box appliance
- Part of
- One Identity Unified Identity Security Platform
- Deployment
- Software (Linux/Unix/Windows) or appliance (SSB)
- In India via
- TechBag — quotes, PoCs, GST invoicing, Tier-1 support
Understand identity & access management before you buy it
Most product pages skip this. We start here — so you buy a capability, not a buzzword.
What is log management?
The reliable log pipe — collect, parse, filter and route logs from the whole estate.
syslog-ng is one of the world's most-deployed collectors.
Fragmented logins vs unified identity — the honest table
What consolidation actually replaces, dimension by dimension.
| Dimension | Unprotected / signature email | syslog-ng (One Identity) |
|---|---|---|
| Logs across the estate | Scattered, siloed | One collected pipe |
| Log formats | Messy, varied | Parsed & structured |
| SIEM ingest volume | Raw firehose | Filtered & reduced |
| SIEM cost | High (per-ingest) | Lower TCO |
| A SIEM outage | Logs lost | Disk-buffered, delivered |
| Transport | Plain, unreliable | Encrypted, reliable |
| Destinations | One, hard-wired | Many, flexible routing |
| Vendor lock-in | Tied to one tool | Vendor-neutral pipe |
Logs are the raw material of security and compliance — collect them reliably and cut your SIEM bill. Part of the One Identity platform.
The five pieces of the platform
Vendors love diagrams; buyers need to know what they’re actually operating. Here’s the whole platform, demystified.
Sources
Collects logs from a huge range of sources — Linux/Unix syslog, Windows Event Log, network devices, applications, files and cloud — the whole estate into one pipe.
Parsing & Enrichment
Parses raw logs into structured data and enriches them (GeoIP, key-value, patterns) — turning messy text into usable, queryable events.
Filtering & Classification
Filters, classifies and rewrites logs — dropping noise, tagging what matters, and reducing volume before data reaches costly downstream tools.
Destinations
Routes processed logs to destinations — SIEM, data lake, cloud storage, files, databases — reliably, with disk-buffering so nothing is lost in transit.
Editions & Platform
Open source, Premium Edition, and the Store Box appliance — part of One Identity's platform, complementing security and identity across the portfolio.
One log pipeline from any source to any destination — parsed, enriched and filtered on the way, so the SIEM gets signal.
Twelve capabilities. Collect, process, deliver.
syslog-ng is the reliable log pipe under your security stack — collecting, reducing and routing everything, part of the One Identity portfolio.
Broad Source Collection
Collects from Linux/Unix, Windows Event Log, network devices, applications, files and cloud — one pipe for the whole estate's logs.
Windows Event Collection
Agent and agentless Windows Event Log collection, including clustered collectors — the Microsoft estate's logs, gathered reliably.
High-Throughput Ingestion
Handles very high message rates — the throughput to collect logs from thousands of sources without becoming the bottleneck.
Parsing & Structuring
Parses raw log text into structured fields — turning unusable strings into queryable, correlatable events for downstream tools.
Enrichment
Enriches logs with context — GeoIP, key-value extraction, pattern matching, lookups — so events arrive downstream already meaningful.
Filtering & Classification
Filters out noise and classifies what matters — only the relevant logs go forward, cutting the volume costly SIEMs must process.
Transform & Rewrite
Rewrites and anonymises log content in flight — normalise formats, mask sensitive data, and reshape events before delivery.
Volume Reduction (SIEM TCO)
Reduces and pre-processes logs before they reach the SIEM — cutting ingest volume and lowering the total cost of expensive, per-ingest-priced tools.
Flexible Routing
Routes logs to multiple destinations at once — SIEM, data lake, cloud storage, files, databases — the right data to the right place.
Disk-Buffering & Reliability
Disk-based buffering and reliable transport mean no log is lost if a destination is down — the reliability compliance and security depend on.
Secure Transport & Storage
Encrypted, authenticated log transport and tamper-evident storage (Store Box) — logs protected in transit and at rest for compliance.
Store Box Appliance (SSB)
The turnkey log-management appliance — collect, search, store and secure logs with a searchable UI, without building it yourself.
Watch One Identity syslog-ng in action
The overview, getting started, and the core workflows.
syslog-ng: Introduction to Log Management
Log management with syslog-ng, explained.
syslog-ng Store Box: A Turnkey Log Appliance
The Store Box log-management appliance.
Installing syslog-ng on CentOS 7
Getting syslog-ng running.
Want a live, India-context walkthrough for your environment?
Book a guided demo →Passwords are the breach. Own the identity layer.
Here’s what genuinely sets One Identity syslog-ng apart in log management.
Logs are the raw material of security and compliance
Logs from servers, network devices, apps and security tools underpin security monitoring, compliance evidence and troubleshooting, but only if they are reliably collected, parsed and delivered to a SIEM, data lake or archive. Without a reliable pipe, the SIEM has gaps and investigators fly blind; syslog-ng is that pipe.
It lowers your SIEM bill
SIEMs are often priced by data ingested, and log volumes keep growing. syslog-ng sits in front of the SIEM, filtering noise, dropping what you don’t need, and parsing, normalising and aggregating the rest, so the SIEM receives a smaller, cleaner stream. The ingest savings alone often justify it, and the data quality improves too.
Reliability you can bet compliance on
A lost log may be the one recording a breach. syslog-ng buffers to disk when a destination such as the SIEM is down and delivers when it recovers, uses reliable encrypted transport, and handles very high message rates, so nothing is dropped during outages or the log floods that come with incidents.
One pipe for a fragmented estate
Estates mix Linux, Unix, Windows, multi-vendor network gear, applications and cloud services, each logging differently. syslog-ng collects from that range, parses formats into structured data, enriches it and routes it anywhere, giving one vendor-neutral pipeline that feeds SIEMs, data lakes or observability tools.
From open source to enterprise to appliance
syslog-ng is one of the world’s most widely deployed open-source log collectors. Premium Edition adds enterprise features and support, and syslog-ng Store Box (SSB) is a turnkey appliance that collects, searches, stores and secures logs. It joined One Identity through the 2018 Balabit acquisition.
The honest scope
syslog-ng is a log collection, processing and routing engine, not a SIEM: detection, correlation and investigation stay with Splunk, Microsoft Sentinel or Elastic, which it feeds with cheaper, cleaner data. For basic needs the open-source edition or a cloud-native pipeline may suffice; Premium and Store Box add enterprise reliability.
The numbers behind the platform
What your log-management journey looks like
Logging scoping
Your log sources (Linux, Windows, network, apps, cloud), SIEM and its ingest cost, and retention needs. TechBag scopes it free.
Collect & parse
syslog-ng deployed; key sources connected; parsing and enrichment configured; reliable, disk-buffered transport established.
Reduce & route
Filtering and reduction cutting SIEM ingest volume; routing to SIEM, data lake and storage; Store Box for searchable retention if scoped.
Reliable & cheaper
One reliable log pipe feeding everything, no logs lost, SIEM cost measurably reduced. TechBag models the edition mix in INR/GST.
The review scoreboard
Modelled on Gartner Peer Insights structure. *Counts and breakdowns are illustrative pending verified review collection.
Quick poll — what’s driving your evaluation?
Talk to an advisor“We put syslog-ng in front of our SIEM and cut ingest volume by a large margin — the licensing saving alone paid for it. And the data quality went up.”
“Disk-buffering is why we trust it for compliance logs. A SIEM outage doesn't mean lost logs anymore — they're buffered and delivered when it's back.”
“One pipe for Linux, Windows, network gear and apps. It parses and normalises everything so downstream tools get clean, structured events.”
“The Store Box appliance gave us searchable, secure log storage without building the infrastructure. Turnkey log management.”
“It handles our message rates without breaking a sweat — even during incidents when the log flood hits. It keeps up when we most need it.”
“Vendor-neutral is the point. It feeds whatever SIEM or data lake we choose — we're not locked in, and we can reduce cost before ingest.”
“The open-source roots mean it's battle-tested everywhere. Premium Edition added the support and reliability features we needed for production.”
“Configuration has a learning curve, but the power is worth it — filtering, parsing and routing exactly how we want. Best log pipe we've used.”
Where everyone sits — the grids
Analyst firms bury this view behind paywalls, and review-site grids score satisfaction, not fit for your estate. So here’s TechBag’s synthesis of the identity & access market — tap any vendor to see why it sits where it does.
TechBag Log Management Grid
Execution strength vs product vision — the classic market map, minus the paywall.
The reliable, vendor-neutral log pipe that cuts SIEM cost. This page's product.
Log-Collection Depth × Enterprise Backing
The grid nobody publishes — log-collection depth vs enterprise support & platform backing.
Deep, reliable collection/processing with enterprise support and an appliance option.
Positions are TechBag’s illustrative synthesis of public review-platform data and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
syslog-ng vs the log-management field
Open-source collectors, SIEM-native and cloud pipelines — honest lanes; the edge is reliable, vendor-neutral collection that cuts SIEM cost, with enterprise support.
| Dimension | syslog-ng | rsyslog / Fluentd | SIEM-native collectors | Cloud log pipelines | No log layer |
|---|---|---|---|---|---|
| Role | The reliable log pipe | Open-source collectors | Tied to the SIEM | Cloud-native | The gap |
| Reliability (no loss) | Disk-buffering | Varies | Varies | Managed | None |
| SIEM cost reduction | A key strength | Possible | None | Some | None |
| Source breadth & parsing | Very broad | Broad | SIEM-focused | Cloud-focused | None |
| Best fit | A reliable, vendor-neutral log pipe that cuts SIEM cost, with enterprise support | DIY open-source collection | All-in on one SIEM's collectors | Purely cloud-native logging | Nobody doing security or compliance |
Which identity & access management approach fits you?
Honest fit signals — because the fastest way to lose your trust is to pretend one product wins every scenario.
Choose syslog-ng if…
- You want a reliable, vendor-neutral log pipe feeding your SIEM/data lake
- You want to cut SIEM ingest volume and lower its total cost
- You need no-log-loss reliability for compliance (disk-buffering)
- You want enterprise support, breadth and a turnkey appliance option
Choose rsyslog / Fluentd if…
- You want open-source collection and have the DIY appetite
Use SIEM-native collectors if…
- You're all-in on one SIEM and its native ingestion suffices
Use cloud log pipelines if…
- Your estate is purely cloud-native and provider tools cover it
No log layer if…
- Never — no reliable logs means no monitoring, compliance or forensics
What could this save you?
Drag the sliders (count users; IT-hour cost as loaded rate). Estimates assume ~1.5 hours per user per year of manual effort this tool automates away, with ~70% of that effort removed — the avoided-risk value is the larger, unpriced win. Illustrative.
Loaded cost = salary + overheads per productive hour. Illustrative only — your TechBag quote models your actual environment and modules.
Three ways to consume it
syslog-ng prices by edition and throughput (open source, Premium Edition, Store Box). TechBag scopes it for your logging estate in one GST quote.
syslog-ng
Best for the log pipe
- Collect from the whole estate
- Filter & reduce SIEM ingest
- Disk-buffered, no logs lost
+ Platform add-ons
Best for a broader rollout
- Scoped to your estate
- Add-on modules as needed
- Phased, right-sized deployment
+ Store Box / Premium
Best for enterprise assurance
- Enterprise support & reliability
- Turnkey appliance & searchable storage
- TechBag scopes the edition mix
Buy it for less — TechBag pricing beats list
Whatever the list prices above, TechBag negotiates a significantly better deal — with GST-compliant INR invoicing and local support. Ask us for your discounted quote.
Get an India-ready quote
Tell us your requirements and current tools — we’ll model it against what you spend today.
The 8 questions to ask every vendor
Take this into your next vendor call — including ours.
Confirm collection from ALL your sources — Linux/Unix, Windows Event Log, network devices, apps, cloud.
Measure the ingest-volume reduction syslog-ng achieves before your SIEM — the direct TCO saving.
Test disk-buffering — simulate a SIEM outage and confirm no logs are lost, just delayed and delivered.
Verify parsing and enrichment turn your messiest log formats into structured, usable events.
Confirm flexible routing to multiple destinations at once — SIEM, data lake, storage.
Decide open source vs Premium Edition vs Store Box — reliability, support and packaging needs.
Verify encrypted, authenticated transport and tamper-evident storage for compliance logs.
Right-size by throughput/sources — TechBag scopes and quotes in INR/GST.
Questions buyers ask
Ready to build a reliable log pipe?
Scope a syslog-ng PoC (collect, parse and reduce your logs, measure the SIEM saving), or let a TechBag advisor plan your log-management architecture and edition mix.
Stats, ratings, review counts and pricing are illustrative and sourced from public materials; verify before purchase.