On Tue, 23 Oct 2018 at 07:37, Rick Moen <rick@???> wrote:
> The mainstream choices (disregarding journald) in 2018 are rsyslog and
> syslog-ng, period. A case could be made for either. I _think_
> rsyslog remains more common. I've personally only encountered
> syslog-ng in embedded logging appliances manufactured by Hungarian firm
> Balabit, which also is the primary code maintainer for the open source
> codebase, offering an enhanced proprietary version to customers.
> Consequently, syslog-ng can be considered a case of 'open core' in the
> sense that syslog-ng is always at risk of being the disregarded
> stepchild because more effort is put into the proprietary 'Premium Edition'.
> (This is part of the reason I personally continue to favour rsyslog,
> but not vehemently.)
>
> 2007 comparison:
> https://web.archive.org/web/20170612021518/http://blog.gerhards.net/2007/08/why-does-world-need-another-syslogd.html

Even Poettering recommends rsyslog for some use cases

https://github.com/systemd/systemd/issues/1291

--Tom