# Install syslog-ng with Homebrew, apk, apt, dnf, MacPorts, pacman, zypper Log daemon with advanced processing pipeline and a wide range of I/O methods. Version 4.12.0 via Homebrew; verified 2026-07-02. ## Install ```sh sudo av install brew:syslog-ng ``` Additional install commands: ### macOS - Homebrew (100%): ```sh brew install syslog-ng ``` Evidence: local Homebrew formula metadata - MacPorts (94%): ```sh sudo port install syslog-ng ``` Evidence: MacPorts ports tree: sysutils/syslog-ng/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1 ### Linux - apk (92%): ```sh sudo apk add syslog-ng ``` Evidence: Alpine Linux edge package indexes: syslog-ng from https://dl-cdn.alpinelinux.org/alpine/edge/main/x86_64/APKINDEX.tar.gz - Debian apt (92%): ```sh sudo apt install syslog-ng ``` Evidence: Debian stable package indexes: syslog-ng from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz - dnf (92%): ```sh sudo dnf install syslog-ng ``` Evidence: Fedora Rawhide package metadata: syslog-ng from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/e5ca8ce900cd68f5419e1c39ae517343100b306336cbaeb70a3c153121d95094-primary.xml.zst - pacman (92%): ```sh sudo pacman -S syslog-ng ``` Evidence: Arch Linux sync databases: syslog-ng from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz - zypper (92%): ```sh sudo zypper install libevtlog-4_11-0 ``` Evidence: openSUSE Tumbleweed package metadata: libevtlog-4_11-0 from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst ## Package facts - **Package key:** brew:syslog-ng - **Package manager:** Homebrew - **Package manager page:** - **Version:** 4.12.0 - **Source summary:** Log daemon with advanced processing pipeline and a wide range of I/O methods - **Homepage:** - **Repository:** - **Upstream docs:** - **License:** LGPL-2.1-or-later AND GPL-2.0-or-later - **Source archive:** - **Last updated:** 2026-07-02T20:34:06Z - **Generated:** 2026-07-08T07:18:31+00:00 ## Executables - dqtool (cli) - loggen (cli) - pdbtool (cli) - persist-tool (cli) - slogencrypt (cli) - slogkey (cli) - slogverify (cli) - syslog-ng (cli) - syslog-ng-ctl (cli) - syslog-ng-debun (cli) - syslog-ng-update-virtualenv (cli) - update-patterndb (cli) - dqtool (alias) - loggen (alias) - pdbtool (alias) - persist-tool (alias) - slogencrypt (alias) - slogkey (alias) - slogverify (alias) - syslog-ng (alias) - syslog-ng-ctl (alias) - syslog-ng-debun (alias) - syslog-ng-update-virtualenv (alias) - update-patterndb (alias) ## Dependencies - abseil - gettext - glib - grpc - hiredis - ivykis - json-c - libdbi - libmaxminddb - libnet - libpaho-mqtt - librdkafka - mongo-c-driver - net-snmp - openssl@3 - pcre2 - protobuf - python@3.14 - rabbitmq-c - riemann-client ## Build dependencies - autoconf - automake - libtool - pkgconf ## Uses from macOS - curl ## Install behavior - Post-install hook: not defined - Bottle: available on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux ## Freshness - Page generated: 2026-07-08 - Package-manager version: 4.12.0 - Package-manager updated: 2026-07-02 - Local data: ok - Upstream repository: https://github.com/syslog-ng/syslog-ng - info: No cached GitHub release or tag data was available. ## Project history and usage syslog-ng is an enhanced syslog daemon for Unix-like systems, used to receive, filter, parse, transform, route, and store system and application logs. ### Project history The project is associated with Balazs Scheidler, named by the upstream repository as the original creator and main developer. An official syslog-ng community post quotes Scheidler saying he began coding the first version in September 1998, after which the project grew from a syslogd replacement into a broader log-processing pipeline. The upstream README describes syslog-ng as supporting classic syslog formats, JSON and unstructured input, parsers, files, message queues, SQL and NoSQL databases, and big-data destinations. It also notes Balabit as the original commercial sponsor and One Identity as the owner after Balabit's 2018 acquisition. ### Adoption history The syslog-ng README says it is integrated into almost all Linux distributions and BSDs. The official community post says early adoption included Debian, Gentoo, SUSE, commercial Unix systems, default logging-daemon roles in some distributions, and embedding in commercial products. The supplied package-manager facts list syslog-ng across Homebrew, Debian, Ubuntu, Fedora/dnf, Alpine/apk, Arch/pacman, MacPorts, and openSUSE/zypper, which matches its long-lived role as a portable logging component. ### How it is used Package users typically install the daemon, edit syslog-ng.conf, then run syslog-ng or service-manager integration to collect local logs, accept network syslog, and forward or store the resulting event stream. Its companion commands such as loggen, pdbtool, persist-tool, and syslog-ng-ctl matter to operators because packaging the project gives more than a daemon: it gives test generators, pattern-database tooling, control commands, and migration helpers. ### Why package nerds care syslog-ng matters in package-manager culture because logging is infrastructure glue: distributions need a daemon with stable config paths, service integration, optional modules, and sane defaults. It is also a classic example of a package whose value depends on compile-time feature detection and optional dependencies; packagers care about which destinations, parsers, TLS, database, and message-queue modules are enabled. ### Timeline - 1998: Balazs Scheidler began coding the first version of syslog-ng. - 2018: One Identity acquired Balabit, the original commercial sponsor named by the upstream README. - 2026: The upstream README describes syslog-ng as integrated into almost all Linux distributions and BSDs. ### Related projects - syslog-ng sits in the syslog/log-processing family alongside traditional syslogd-style daemons and modern telemetry pipelines; the upstream README explicitly points to destinations such as Elasticsearch, Kafka, Hadoop, PostgreSQL, and MongoDB. ### Sources - - - source_facts.package-manager ## Security Notes broad file, network, media, or database tool signal. - **Geiger risk:** blue / medium - broad file, network, media, or database tool signal ## Configuration and credential file locations These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval. ## Configuration files - Unix: /etc/syslog-ng/syslog-ng.conf ## Source Database Details - **Source Database:** Homebrew formula API - **Tap:** homebrew/core - **Full Name:** syslog-ng - **Version Scheme:** 0 - **Revision:** 2 - **Head Version:** HEAD - **Bottle Stable Root URL:** - **Deprecated:** no - **Disabled:** no - **Keg Only:** no - **URL Keys:** head, stable ## Other Package-Manager Records - Debian apt - syslog-ng - 4.8.1-5+deb13u1: normalized package name match | Debian stable package indexes: syslog-ng from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | Enhanced system logging daemon (metapackage) | https://www.syslog-ng.com/ - Debian apt - syslog-ng-core - 4.8.1-5+deb13u1: normalized package name match | Debian stable package indexes: syslog-ng-core from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | Enhanced system logging daemon (core) | https://www.syslog-ng.com/ - Debian apt - syslog-ng-dbg - 4.8.1-5+deb13u1: normalized package name match | Debian stable package indexes: syslog-ng-dbg from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | Enhanced system logging daemon (debug symbols) | https://www.syslog-ng.com/ - Debian apt - syslog-ng-dev - 4.8.1-5+deb13u1: normalized package name match | Debian stable package indexes: syslog-ng-dev from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | Enhanced system logging daemon (development files) | https://www.syslog-ng.com/ - Debian apt - syslog-ng-mod-add-contextual-data - 4.8.1-5+deb13u1: normalized package name match | Debian stable package indexes: syslog-ng-mod-add-contextual-data from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | Enhanced system logging daemon (add-contextual-data plugin) | https://www.syslog-ng.com/ - Debian apt - syslog-ng-mod-amqp - 4.8.1-5+deb13u1: normalized package name match | Debian stable package indexes: syslog-ng-mod-amqp from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | Enhanced system logging daemon (AMQP plugin) | https://www.syslog-ng.com/ - Debian apt - syslog-ng-mod-examples - 4.8.1-5+deb13u1: normalized package name match | Debian stable package indexes: syslog-ng-mod-examples from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | Enhanced system logging daemon (example plugins) | https://www.syslog-ng.com/ - Debian apt - syslog-ng-mod-extra - 4.8.1-5+deb13u1: normalized package name match | Debian stable package indexes: syslog-ng-mod-extra from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | transitional package | https://www.syslog-ng.com/ - Debian apt - syslog-ng-mod-geoip2 - 4.8.1-5+deb13u1: normalized package name match | Debian stable package indexes: syslog-ng-mod-geoip2 from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | Enhanced system logging daemon (GeoIP2 plugin) | https://www.syslog-ng.com/ - Debian apt - syslog-ng-mod-graphite - 4.8.1-5+deb13u1: normalized package name match | Debian stable package indexes: syslog-ng-mod-graphite from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | Enhanced system logging daemon (graphite plugin) | https://www.syslog-ng.com/ - Debian apt - syslog-ng-mod-http - 4.8.1-5+deb13u1: normalized package name match | Debian stable package indexes: syslog-ng-mod-http from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | Enhanced system logging daemon (HTTP destination) | https://www.syslog-ng.com/ - Debian apt - syslog-ng-mod-mongodb - 4.8.1-5+deb13u1: normalized package name match | Debian stable package indexes: syslog-ng-mod-mongodb from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | Enhanced system logging daemon (MongoDB plugin) | https://www.syslog-ng.com/ - Debian apt - syslog-ng-mod-python - 4.8.1-5+deb13u1: normalized package name match | Debian stable package indexes: syslog-ng-mod-python from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | Enhanced system logging daemon (Python plugin) | https://www.syslog-ng.com/ - Debian apt - syslog-ng-mod-rdkafka - 4.8.1-5+deb13u1: normalized package name match | Debian stable package indexes: syslog-ng-mod-rdkafka from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | Enhanced system logging daemon (Kafka destination, based on librdkafka) | https://www.syslog-ng.com/ - Debian apt - syslog-ng-mod-redis - 4.8.1-5+deb13u1: normalized package name match | Debian stable package indexes: syslog-ng-mod-redis from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | Enhanced system logging daemon (Redis plugin) | https://www.syslog-ng.com/ - Debian apt - syslog-ng-mod-riemann - 4.8.1-5+deb13u1: normalized package name match | Debian stable package indexes: syslog-ng-mod-riemann from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | Enhanced system logging daemon (Riemann destination) | https://www.syslog-ng.com/ ## Related links - [Secret-risk packages](https://www.automicvault.com/pkg/secret-risk-packages/) - Has protected-tool coverage, approval-gate, or non-low Geiger security signals. - [Terminal utility packages](https://www.automicvault.com/pkg/terminal-utilities/) - Matched terminal and command-line workflow metadata. - [Networking and protocol packages](https://www.automicvault.com/pkg/networking-protocol-tools/) - Matched network, protocol, or remote-service metadata. - [Homebrew utility packages](https://www.automicvault.com/pkg/brew-utility-packages/) - Matched Homebrew package provider. - [gettext](https://www.automicvault.com/pkg/brew/gettext/) - Runtime dependency declared by Homebrew. - [glib](https://www.automicvault.com/pkg/brew/glib/) - Runtime dependency declared by Homebrew. - [grpc](https://www.automicvault.com/pkg/brew/grpc/) - Runtime dependency declared by Homebrew. - [autoconf](https://www.automicvault.com/pkg/brew/autoconf/) - Build dependency declared by Homebrew. - [automake](https://www.automicvault.com/pkg/brew/automake/) - Build dependency declared by Homebrew. - [libtool](https://www.automicvault.com/pkg/brew/libtool/) - Build dependency declared by Homebrew. - [pkgconf](https://www.automicvault.com/pkg/brew/pkgconf/) - Build dependency declared by Homebrew. - [rsyslog](https://www.automicvault.com/pkg/brew/rsyslog/) - Shares av.db curated category or tags: cli, daemon, logging, syslog, system. - [mlogger](https://www.automicvault.com/pkg/brew/mlogger/) - Shares av.db curated category or tags: cli, logging, syslog, system. - [mergelog](https://www.automicvault.com/pkg/brew/mergelog/) - Shares av.db curated category or tags: cli, log-processing, logging, system. - [colortail](https://www.automicvault.com/pkg/brew/colortail/) - Shares av.db curated category or tags: cli, logging, system. - [lazyjournal](https://www.automicvault.com/pkg/brew/lazyjournal/) - Shares av.db curated category or tags: cli, logging, system. - [apcupsd](https://www.automicvault.com/pkg/brew/apcupsd/) - Shares av.db curated category or tags: cli, daemon, system. - [collectd](https://www.automicvault.com/pkg/brew/collectd/) - Shares av.db curated category or tags: cli, daemon, system. - [conman](https://www.automicvault.com/pkg/brew/conman/) - Shares av.db curated category or tags: cli, logging, system. - [netdata](https://www.automicvault.com/pkg/brew/netdata/) - Both packages work with overlapping file formats or content types. Shared terms: abseil, cli, json, json-c, openssl. ## Combined YAML source View the package source record on GitHub. [combined/syslog-ng.yml](https://github.com/automic-vault/db/blob/main/combined/syslog-ng.yml) ## Sources - Nucleus package database - Geiger risk classifier - package-page enrichment - curated configuration and credential file locations - curated package history - package version freshness - av.db category and tag curation - package relationship graph - external package-manager database matches - cross-ecosystem install command graph