Sylo

Welcome to the official homepage of sylo - a daemon for reliable syslog logging over the network.

Sylo ensures that syslog messages are first stored on the disk before sending them over the network to a remote syslog server using TCP. This can prevent loss of syslog messages due to local system failures.

Sylo runs as daemon and is glued between the local syslog agent and the remote syslog server. The local syslog agent needs to put the messages to a local pipe while sylo takes the messages from the pipe, stores them on the disk and then forwards the messages to the remote syslog server using syslog over TCP.

Common Reliability Problems

There is much space for reliability problems when processing logs over the network:

• Logs are processed asynchronous using syslog

  There is no guarantee that a log reaches the destination.

• Most processing is done using the system memory

  Log messages may get lost caused by a system failure when they were kept in the system memory.

  For example when the logserver is not reachable and the client suddenly reboots, the messages which wait in the system memory for the logserver to become available again will be lost.

• UDP as transport protocoll is not reliable

  The client does not get a confirmation wether the sent logs reached the logserver.

• Even TCP as transport protocoll may result in data loss

  It is possible that log messages get lost in the TCP stack on a system failure.

Idea of Sylo

The sylo tries to solve some of those problems in a general way which is not directly related to the used syslog implementation. Sylo has been developed and tested with Syslog-NG and rsyslog, both as clients and servers.

Sylo needs to run on each system which should send syslog messges in a more reliable way. Sylo takes the messages from the local syslog agent and stores all of them in the so called silo.

The silo is a file of fixed size which will never grow. This ensures that there is enough space for storing the logs on the disk all the time even when the local storage is filled up.

Once there is a message in the silo, sylo tries to send those messages to the remote syslog server one after one.

If the remote syslog server is not reachable the sylo keeps trying without removing the message from the silo. And even if a system failure occurs on your local system which needs a reboot the logs are stored in the silo and don't get lost.

Availability and Support

Sylo is free software. You can use, modify and redistribute it under the terms of the GNU GPL Version 2. Professional support for sylo is available from us. Please contact us, if you need improvements or general help with setting up sylo.