# syslog vs fluentd

|                    | syslog                                                                                                                                                                                                                                         | fluentd                                                                                                                                                                   |
| ------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Definition         | A standard(protocal) for message logging                                                                                                                                                                                                       | A logging agent pulls, processes, puhses log messages                                                                                                                     |
| Run as             | rsyslogd (for PKS)                                                                                                                                                                                                                             | fluentd or run as a container                                                                                                                                             |
| Transport protocol | TCP/UDP/RELP                                                                                                                                                                                                                                   | HTTP/HTTPS                                                                                                                                                                |
| Log source         | wide range of network devices                                                                                                                                                                                                                  | log files/network/socket/execution/etc                                                                                                                                    |
| Pros               | <ul><li>support a wide range of network devices, like routers</li></ul>                                                                                                                                                                        | <ul><li>more secure if using HTTPS</li><li>customizable configurations for log sources, filter rules, tagging, reformatting</li><li>consistency of log messages</li></ul> |
| Cons               | <ul><li>message loss if using UDP</li><li>log entries are not very human readable</li><li>hard to do log process. e.g. tag, reformat</li><li>security issue (one machine could impersonate another machine to send bogus log events)</li></ul> | <ul><li>need to add log source manually</li></ul>                                                                                                                         |

##

