News

Keeping rsyslog Accessible Worldwide

The rsyslog project continues to evolve — not only in performance and functionality, but also in how it ensures reliable global access for developers and users. In a time of increasing network fragmentation, rsyslog’s infrastructure is designed to remain reachable, maintainable, and open, regardless of regional conditions.

A long tradition of openness

Since its early days on SourceForge and CVS, rsyslog has steadily adapted to modern platforms while avoiding vendor or platform lock-in. The project migrated from CVS to git, then from self-hosted systems to GitHub, and now extends its reach through a set of regional mirrors. Each transition has followed one guiding principle: technology should remain open and accessible to all.

The rsyslog team has consistently favored diversity in infrastructure — multiple CI systems, different hosting providers, and redundant build and test paths. Even though GitHub currently serves as the canonical repository, rsyslog’s CI ecosystem includes additional components such as Buildbot instances and Gitea-based mirrors, ensuring that no single platform is essential for the project’s operation.

Global mirrors for accessibility

To further strengthen accessibility, rsyslog now provides regional mirrors for easier source code access:

These mirrors are intended purely for accessibility and resilience. They are not regional forks — all contributions and CI processes remain integrated through GitHub, where automated testing and code review take place. For developers affected by access restrictions, the team offers to forward contributions manually, ensuring that valuable work is never lost due to technical or political boundaries.

Built for resilience

This step builds upon rsyslog’s long-standing philosophy of redundant and distributed operations. During the COVID-19 pandemic and the European energy crisis, rsyslog maintained hot-standby mirrors of critical infrastructure — including its websites and CI components — in multiple data centers across regions. At peak uncertainty, DNS round-robin configurations and database replication allowed instant failover between European and U.S. nodes.

DigitalOcean continues to power parts of this network as an open-source sponsor, alongside additional providers that ensure geographic and operational diversity. At one point, when energy availability in Germany became a concern, a key system was temporarily relocated to Norway — demonstrating the flexibility and readiness of rsyslog’s infrastructure. The result is a system designed to survive global disruptions while keeping the project available to everyone who depends on it.

Philosophy and next steps

The addition of regional mirrors is part of a broader commitment to openness, reliability, and technological neutrality. rsyslog remains apolitical but proactive in maintaining accessibility — even as the world becomes more fragmented. The guiding idea is simple and enduring:

Open source should have no borders.

(FR) Le code ouvert ne devrait pas avoir de frontières
(ZH) 开源应该没有边界
(JA) オープンソースに国境はない
(ES) El código abierto no debe tener fronteras
(HI) ओपन सोर्स की कोई सीमाएँ नहीं होनी चाहिए
(AR) المصدر المفتوح يجب ألا يكون له حدود

Future improvements may include additional mirrors or CI redundancy on alternative platforms. For now, users and contributors can find the latest information — including all mirror links — in the main repository README.

Adiscon joins connect.IT Heilbronn-Franken — why this matters to rsyslog

Adiscon, the main sponsor of rsyslog, has joined connect.IT Heilbronn-Franken, a regional non-profit network linking companies, startups, universities, and public institutions across AI, data, cloud, and cybersecurity. We highlight connect.IT because it is a strong regional hub, and we are here to learn.

Expert networks underpin success in today’s complex IT landscape. We team up with peers to learn from real-world challenges and to share what proves to work. (Symbol Image: Rainer Gerhards via AI)
Continue reading “Adiscon joins connect.IT Heilbronn-Franken — why this matters to rsyslog”

rsyslog 8.2510.0 (2025.10) released

We have today released the 8.25100 rsyslog scheduled stable release. This release delivers three main themes: better Windows Security event ingestion, more flexible JSON handling end to end, and pragmatic compatibility fixes across popular outputs and platforms. It also includes steady documentation improvements and CI hardening.

Continue reading “rsyslog 8.2510.0 (2025.10) released”

Modern Snare-Format Parsing Arrives: Introducing the mmsnareparse Module

Last September, Rainer Gerhards revisited a long-standing challenge: normalizing legacy Windows Snare logs for use in modern observability pipelines.
In his article Revisiting old style Windows Log Schema Mapping, he explored heuristic and AI-assisted methods to better handle these still-prevalent formats.

That effort has now resulted in production-ready code: the new mmsnareparse module — already part of the daily stable build and scheduled for inclusion in the 8.2510.0 stable release.

We’re looking for testers right now.
If your systems still forward Windows Security logs in Snare format, please deploy mmsnareparse and let us know how it performs in your environment.
Real-world feedback will directly shape future development.

Symbol Picture for Status Update postings. (Image: Rainer Gerhards via AI)
Continue reading “Modern Snare-Format Parsing Arrives: Introducing the mmsnareparse Module”

Rsyslog project update: faster reviews, clearer process

Summary
We are tightening our contribution workflow to improve review speed and predictability. Expect reasonable turnaround times, not instant responses. This is rolling out now.

What changes now

  • Initial PR look: Maintainer aims to glance at each new PR within 3 business days.
  • AI review on PRs: Runs automatically on open. In our experience it is 90%+ correct and provides actionable items.
  • Full review trigger: Deeper maintainer review typically follows when CI is green and AI items are fixed or clearly explained.
  • Old issues policy: No mass closures. We are revisiting older items with AI assist and closing them for the right reasons, often by implementing what is needed.
  • Labels and dashboards: We are formalizing labels (including good first issue) and lightweight dashboards to make navigation and triage easier. Details will follow in a separate post.
  • Responsible AI First: We use AI to speed feedback, but only where it adds real value and the results make sense.
Continue reading “Rsyslog project update: faster reviews, clearer process”

rsyslog 8.2508.0 (2025.08) – release announcement

Download: https://www.rsyslog.com/files/download/rsyslog/rsyslog-8.2508.0.tar.gz
Project-provided packages are building now and are expected later today. Ubuntu PPAs are already done.

We are excited to ship a large and meaningful rsyslog release. This cycle advances our responsible “AI First” strategy and moves decisively toward cloud native operations. It also delivers major quality, security, and documentation improvements.

Continue reading “rsyslog 8.2508.0 (2025.08) – release announcement”
Scroll to top