Balabit syslog-ng

Balabit IT Security is an international security vendor headquartered in Luxembourg, founded in 2000 in Hungary, and still operating R&D centers there while maintaining sales offices across Europe, the US, and Russia. Its portfolio spans log management, privileged activity monitoring, and user behavior analytics, bundled as the Contextual Security Intelligence (CSI) Suite. The company’s best-known product is syslog-ng, a widely deployed log management tool for Unix-like systems with over a million installations.

Amid rising attack volumes and regulatory compliance demands, organizations increasingly need stronger event and incident analysis and response capabilities. The market splits between domain-specific tools (e.g., identity and access, privileged accounts, specialized network analytics) and generic cross-system log solutions, including log collection, SIEM, and more advanced Real Time Security Intelligence (RTSI). These tools are often complementary: log collectors can pre-process for SIEM, and SIEM can feed advanced analytics.

syslog-ng can serve either as a customizable log analysis platform or as an upstream collector/filter in front of SIEM. It comes in three editions: the Open Source Edition (OSE), the commercial Premium Edition (PE), and Store Box (SSB), an appliance. OSE extends traditional syslogd with content-based filtering, parsing/rewriting, pattern classification, correlation, metadata enrichment, broader sources/destinations (e.g., JSON, MongoDB), scalability features (multi-threading), queueing (AMQP/STOMP), TLS, and reliable TCP transport. PE adds cross-platform installers, Windows and IBM System i support via agents, and stronger security such as encryption, signing, timestamping, disk buffering, SQL destinations, and the proprietary Reliable Log Transfer Protocol (RLTP) to prevent loss or duplication. PE also introduced direct integration into Big Data targets (Hadoop, Elasticsearch, MongoDB, Kafka), centralized deployment via Puppet, improved monitoring statistics, and performance gains. SSB adds a web UI for search, drill-down, reporting, LDAP/RADIUS-based access control, multi-logspace support, and can act as a SIEM alternative or noise-reducing filter. Strengths center on breadth, security, Big Data integration, and manageability; challenges include limited preconfigurations and comparatively limited agent coverage.

• Balabit IT Security is headquartered in Luxembourg and was founded in 2000 in Hungary.
• Research and development centers remain located in Hungary.
• Sales offices exist in Europe, the US, and Russia, supported by a large partner network.
• Balabit’s portfolio spans log management, privileged activity monitoring, and user behavior analytics within the CSI Suite.
• syslog-ng is used in over a million installations worldwide.
• syslog-ng is offered in three editions: Open Source Edition (OSE), Premium Edition (PE), and Store Box (SSB).
• syslog-ng OSE supports outputs such as MongoDB and JSON, and supports Hadoop and Elasticsearch.
• syslog-ng OSE supports message queueing protocols including AMQP and STOMP.
• syslog-ng PE supports encryption, signing, and timestamping of messages, plus disk-based buffering.
• syslog-ng PE includes a proprietary Reliable Log Transfer Protocol (RLTP) that prevents message loss and duplication during transfer failures.

• “Among these solutions, the company’s oldest and undeniably most well-known is syslog-ng, the de-facto standard log management tool for Unix-like platforms.”
• “Most of these tools are not exclusive but, at least to a certain extent, complementary.”
• “Log collection and filtering can be used as sort of a pre-processor to SIEM.”
• “As the name implies, syslog-ng is a new-generation replacement for the standard syslogd (syslog daemon).”
• “This enables various interesting usage scenarios, where syslog-ng serves as a centralized Big Data digestion point from various data sources.”
• “With syslog-ng, all this data is collected and pre-processed using unified transformation rules and then fed directly into various Big Data destinations.”
• “Thus, different units within the organization (such as marketing, developers and security experts) can have immediate access to exactly the data they need without unnecessary duplication.”
• “SSB, in fact, goes well beyond a log collection and processing utility that sits in front of a SIEM solution but adds its own analytical capabilities.”
• “SSB can be considered a full alternative for many of the common SIEM solutions.”
• “Nevertheless, as a standalone product it is still just a tool, not a solution preconfigured for certain use cases.”