Author : Rainer Gerhards

Keeping rsyslog Accessible Worldwide

The rsyslog project continues to evolve — not only in performance and functionality, but also in how it ensures reliable global access for developers and users. In a time of increasing network fragmentation, rsyslog’s infrastructure is designed to remain reachable, maintainable, and open, regardless of regional conditions.

A long tradition of openness

Since its early days on SourceForge and CVS, rsyslog has steadily adapted to modern platforms while avoiding vendor or platform lock-in. The project migrated from CVS to git, then from self-hosted systems to GitHub, and now extends its reach through a set of regional mirrors. Each transition has followed one guiding principle: technology should remain open and accessible to all.

The rsyslog team has consistently favored diversity in infrastructure — multiple CI systems, different hosting providers, and redundant build and test paths. Even though GitHub currently serves as the canonical repository, rsyslog’s CI ecosystem includes additional components such as Buildbot instances and Gitea-based mirrors, ensuring that no single platform is essential for the project’s operation.

Global mirrors for accessibility

To further strengthen accessibility, rsyslog now provides regional mirrors for easier source code access:

These mirrors are intended purely for accessibility and resilience. They are not regional forks — all contributions and CI processes remain integrated through GitHub, where automated testing and code review take place. For developers affected by access restrictions, the team offers to forward contributions manually, ensuring that valuable work is never lost due to technical or political boundaries.

Built for resilience

This step builds upon rsyslog’s long-standing philosophy of redundant and distributed operations. During the COVID-19 pandemic and the European energy crisis, rsyslog maintained hot-standby mirrors of critical infrastructure — including its websites and CI components — in multiple data centers across regions. At peak uncertainty, DNS round-robin configurations and database replication allowed instant failover between European and U.S. nodes.

DigitalOcean continues to power parts of this network as an open-source sponsor, alongside additional providers that ensure geographic and operational diversity. At one point, when energy availability in Germany became a concern, a key system was temporarily relocated to Norway — demonstrating the flexibility and readiness of rsyslog’s infrastructure. The result is a system designed to survive global disruptions while keeping the project available to everyone who depends on it.

Philosophy and next steps

The addition of regional mirrors is part of a broader commitment to openness, reliability, and technological neutrality. rsyslog remains apolitical but proactive in maintaining accessibility — even as the world becomes more fragmented. The guiding idea is simple and enduring:

Open source should have no borders.

(FR) Le code ouvert ne devrait pas avoir de frontières
(ZH) 开源应该没有边界
(JA) オープンソースに国境はない
(ES) El código abierto no debe tener fronteras
(HI) ओपन सोर्स की कोई सीमाएँ नहीं होनी चाहिए
(AR) المصدر المفتوح يجب ألا يكون له حدود

Future improvements may include additional mirrors or CI redundancy on alternative platforms. For now, users and contributors can find the latest information — including all mirror links — in the main repository README.

Adiscon joins connect.IT Heilbronn-Franken — why this matters to rsyslog

Adiscon, the main sponsor of rsyslog, has joined connect.IT Heilbronn-Franken, a regional non-profit network linking companies, startups, universities, and public institutions across AI, data, cloud, and cybersecurity. We highlight connect.IT because it is a strong regional hub, and we are here to learn.

Expert networks underpin success in today’s complex IT landscape. We team up with peers to learn from real-world challenges and to share what proves to work. (Symbol Image: Rainer Gerhards via AI)
Continue reading “Adiscon joins connect.IT Heilbronn-Franken — why this matters to rsyslog”

New rsyslog AI Assistant — powered by DigitalOcean Gradient

We are excited to introduce a second rsyslog Assistant, now live at rsyslog.ai. It runs on the DigitalOcean Gradient platform and uses the Llama 3.3 Instruct (70B) open-source model — offering no-login, privacy-friendly, and open access to rsyslog expertise.

A new rsyslog Assistant: open, private, and ready to learn. (Image: Rainer Gerhards via AI)
Continue reading “New rsyslog AI Assistant — powered by DigitalOcean Gradient”

rsyslog 8.2510.0 (2025.10) released

We have today released the 8.25100 rsyslog scheduled stable release. This release delivers three main themes: better Windows Security event ingestion, more flexible JSON handling end to end, and pragmatic compatibility fixes across popular outputs and platforms. It also includes steady documentation improvements and CI hardening.

Continue reading “rsyslog 8.2510.0 (2025.10) released”

Modern Snare-Format Parsing Arrives: Introducing the mmsnareparse Module

Last September, Rainer Gerhards revisited a long-standing challenge: normalizing legacy Windows Snare logs for use in modern observability pipelines.
In his article Revisiting old style Windows Log Schema Mapping, he explored heuristic and AI-assisted methods to better handle these still-prevalent formats.

That effort has now resulted in production-ready code: the new mmsnareparse module — already part of the daily stable build and scheduled for inclusion in the 8.2510.0 stable release.

We’re looking for testers right now.
If your systems still forward Windows Security logs in Snare format, please deploy mmsnareparse and let us know how it performs in your environment.
Real-world feedback will directly shape future development.

Symbol Picture for Status Update postings. (Image: Rainer Gerhards via AI)
Continue reading “Modern Snare-Format Parsing Arrives: Introducing the mmsnareparse Module”
Scroll to top