Well to be honest.. I have only used syslog-ng over any of the
replacements out there. I found a webpage listing the replacements:
http://www.loganalysis.org/sections/syslog/syslog-replacements/
Please correct me if I am wrong, but there are 3 parts to what Sopwith
is asking:
1) Better API? [This would seem to require changes in LOTS of
applications, glibc, and kernel to deal with this better API.] From my
readings in the last month on this.. I dont think any of the syslog
authors would say that the current API couldnt use a complete
overhaul.
2) Able to replace what is currently there.
3) Able to handle the increased loads that people are wanting...
I am guessing that the current tools need a testing to see what would
meet those needs.
--
Stephen J Smoogen.
CSIRT/Linux System Administrator