On Tue, Dec 09, 2025 at 02:15:53PM +0100, Didier Kryn wrote:
>     Looking for alternatives to rsyslog in the package repository (still in
> Daedalus), I see:
>
>     busybox-syslogd
>     inetutils-syslogd
>     rsyslog
>     syslog-ng

metalog is now in Devuan ceres and freia!

Here is the full list:

busybox-syslogd 1:1.37.0-10
inetutils-syslogd 2:2.7-3
metalog 20260221-1
rsyslog 8.2512.0-3devuan1
socklog-run 2.1.2+repack-1
syslog-ng-core 4.8.1-7+b2

Metalog was last in Debian 19 years ago. Sysvinit and runit integration
is included in the package.

This is another 'logging directory' style syslogger, like socklog, so
the main log file is:

/var/log/syslog/current

>     I imagine inetutils-syslogd is the legacy syslogd server. I guess it
> doesn't provide any of the dispatching facilities of rsyslog.
> busybox-syslogd is rather dedicated to diskless boxes; it can, at least
> forward the messages to a remote host, but the remote host needs a more
> featurefull log mamagement.
>
>     syslog-ng seems pretty rich also (as from the number of debian
> packages).

metalog has a few filtering and despatching capabilities, but is way
simpler than syslog-ng.

Somewhere in this thread Harald asks about logging with syslog-ng to
/dev/tty12. IIRC syslog-ng logs to /dev/tty10 by default but I'm not
sure how to tune that.

With metalog, I am not sure what you would do with the initscript but
with the runit service you can drop the '-1' chpst option from
/etc/sv/metalog/run to get logging to the console and then add a
redirection to /dev/tty12.

As regards the original subject of this thread, fail2ban - I'm not sure
if that works with the directory-based loggers - something to
investigate!

Andrew