Rainer Gerhards, Author at Rainer Gerhards

2025-11-282025-11-28

CyberSicherheitsForum Baden-Württemberg 2025: Notes from an rsyslog Perspective

Yesterday I attended the CyberSicherheitsForum Baden-Württemberg in Stuttgart. Program link: https://cybersicherheitsforum-bw.de/

For non-German readers: Baden-Württemberg is one of Germany’s federal states (Bundesländer), and an important IT region in its own right. Companies like SAP SE and Schwarz Digits are based here, and the Open Source ecosystem is active as well. When the state talks about digital sovereignty or security strategies, it is usually backed by real capabilities in industry and administration.

Conference hall with many attendees seated, large screens on stage showing the opening session of the CyberSicherheitsForum Baden-Württemberg. — Photo taken during the opening session of the CyberSicherheitsForum Baden-Württemberg 2025 in Stuttgart. (Rainer Gerhards)

2025-11-172025-11-17

The Real Scope Behind the rsyslog Documentation Overhaul

For a concise Computer Science summary of this effort, see the section at the end of this article.

When I began the current documentation overhaul, the objective was never limited to cleaning up a few pages. From the beginning, the plan was to prepare rsyslog for the AI era. And the truth is simple: without modern AI tooling, this work would not have been feasible at this depth or speed.

Symbolic illustration showing documentation, an AI head, and a graph structure representing RAG.

2025-11-072025-11-07

YAML for rsyslog — a new option, not a revolution

rsyslog’s configuration language has grown into a very capable scripting environment — RainerScript — that can express almost anything a log pipeline might need. For complex systems, that won’t change.
But many modern environments — especially containerized and cloud-native ones — expect configuration in YAML. So the idea is simple: rsyslog should understand that world directly.

Symbol image for “Engineering Rational” type of postings. (Image: Rainer Gerhards via AI)

2025-10-292025-10-29

Having a good Time with DO Gradient AI

I thought I provide a quick “happy camper” status update. Even though this was only a side-activity, I had an exceptionally good day working with Digital Ocean Gradient and open source models. I am working on support Agents for the rsyslog ecosystem.

rsyslog site with DO Gradient-based AI Agent. Right now, we do not auto-expand it, but this might change.

2025-10-242025-10-17

Schema transformation and the road to YAML in mmjsontransform

The recent GitHub issue #6251 marks another step in our ongoing modernization work. The topic sounds narrow — enhancements for mmjsontransform — but it connects to a much larger theme: how rsyslog handles structured data and how we can make that power easier to use.

2025-10-232025-10-16

Adiscon joins connect.IT Heilbronn-Franken

Adiscon (rsyslog’s main sponsor) has joined connect.IT Heilbronn-Franken. Short version: I want more first-hand input from real deployments in AI, logging, and security. Local practitioners have plenty of it. Turning those lessons into clear guidance helps the global rsyslog community. Simple.

2025-10-202025-10-16

Why We Built a Second rsyslog AI Assistant — and What It Means

A few days ago, we posted the short announcement on the project site:
👉 New rsyslog AI Assistant — powered by DigitalOcean Gradient

This is the longer story: the plan, the first results, and what we think is sensible to do next.

2025-10-172025-10-24

Looking for an Alternative to Kiwi Syslog? Try WinSyslog.

I’ve been getting a steady stream of questions from admins searching for a dependable Windows syslog server. Many of them mention frustration with recent Kiwi Syslog versions — unclear message parsing, configuration quirks, or just a feeling that things have become harder than they should be. There seems to be especially a lot of frustration with the “Kiwi Syslog Server NG” version, based on the emails I receive.

Since the topic keeps coming up, let me share the same recommendation I give privately. If you’re currently evaluating syslog solutions, this detailed comparison between WinSyslog and Kiwi Syslog Server covers the technical differences and can help inform your decision.

2025-10-142025-10-14

From Stream to Lake: Thinking About rsyslog as the River System Behind Your Data

I recently had a discussion about data lakes. It made me realize that people often picture them as the starting point of data collection — as if all information somehow appears in the lake. In reality, no lake exists without rivers. And in the world of IT systems, rsyslog is part of that river system.

rsyslog is the river system that feeds your data lake. (Image: Rainer Gerhards via AI)

2025-09-232025-10-09

Revisiting old style Windows Log Schema Mapping

Windows logs provide a wealth of information that must be made usable for Observability. As you may know, I work on normalizing these logs for quite some while, I even created liblognorm for that purpose. Ingesting them properly is important for schema mapping, e.g. to Elastic Cloud.