You can centralize logs from firewalls, switches, and Linux hosts with a free syslog server - rsyslog, syslog-ng OSE, and the free plan of NXLog Platform all do the job. The real differences show up in Windows support, secure transport, viewers, and what happens when your environment grows.
A firewall, a switch, or an auditor says "send your logs somewhere," and there’s no budget line for it. A free syslog server solves the immediate problem in an afternoon.
The catch is that free deployments tend to fail quietly. Dropped UDP packets, an unpatched receiver, or a retention gap usually surface during an incident or an audit - the two worst possible times to find out.
We compare six free syslog servers and viewers, set one up with NXLog Platform - UDP, TCP, and TLS listeners with working configs - and end with a checklist for deciding when free stops being enough.
What is a syslog server?
A syslog server is a network service that listens for log messages sent by other systems, including routers, firewalls, Linux servers, and applications. It writes the messages to a central storage where you can search, forward, or archive them.
Syslog messages come in two formats. The legacy BSD format (RFC 3164) is loosely structured and still the default on many network devices. The current IETF standard (RFC 5424) adds a versioned header, precise timestamps, and structured data fields. A capable syslog server parses both.
Transport matters just as much as format:
| Transport | Default port | Standard | What you should know |
|---|---|---|---|
UDP |
514 |
Fire-and-forget. The RFC itself notes that delivery is not guaranteed. |
|
TCP |
514 by convention |
Published as a Historic RFC - it documents existing practice rather than defining a standard. |
|
TLS |
6514 |
Encrypted and authenticated. The transport the IETF recommends. |
Most appliances still default to UDP, so in practice you’ll deal with all three.
Syslog server vs. syslog viewer vs. SIEM
These three terms get mixed up constantly, and the confusion leads teams to buy the wrong tool. Here’s the short version.
A syslog server (or collector) receives messages over the network, parses them, and stores or forwards them. It’s infrastructure: rsyslog, syslog-ng, and NXLog Agent instances all fit here.
A syslog viewer is the interface you read logs through - anything from tail -f on a flat file to an indexed web UI with saved searches.
Many free syslog servers ship without one, which is fine on day one and painful by month three.
A SIEM adds correlation rules, detection content, alerting workflows, and case management on top of collected logs. If you’re writing detection rules and tracking investigations, you’ve left syslog server territory. Most SIEMs ingest from your syslog infrastructure rather than replacing it.
Free syslog servers compared
Here are six free syslog servers compared on license, platform support, transport security, viewers, and caps - our own products included.
| Tool | License | OS | RFC 5424 | TLS syslog | Built-in viewer | Caps and maintenance |
|---|---|---|---|---|---|---|
Proprietary, free plan |
On-premises server; agents for Windows, Linux, macOS, and more |
Yes |
Yes |
Yes - web search and dashboards |
Up to 10 sources with full features; actively developed |
|
GPLv3 |
Linux |
Yes |
Yes |
No |
No caps; active |
|
LGPLv2.1 core, GPLv2 modules |
Linux/Unix |
Yes |
Yes |
No |
No caps; active |
|
SSPL v1 (source-available) |
Linux; requires MongoDB and OpenSearch |
Yes |
Yes |
Yes - web UI |
Free, self-managed; substantial stack to operate; active |
|
Proprietary |
Windows |
Not documented for the free edition |
Not documented for the free edition |
Yes - Windows GUI |
Five sources; the paid edition removes the cap. Legacy KSS reached end of service life in March 2026; NG is the current line |
|
GPLv2 |
Windows (listed support ends at 8.1/Server 2012) |
No - RFC 3164 only |
No |
Yes - live GUI |
Dormant; latest release is 1.6.4 |
NXLog Platform (Free plan)
NXLog Platform is an on-premises log management product, and its Free plan covers up to 10 sources with no feature limits. That includes the current NXLog Agent for collection, centralized agent management, and built-in storage with a web-based search UI. It’s the only tool on this list that combines its own agent, central agent management, and a search UI in one free package. The limits: 10 sources, and community support rather than an SLA.
rsyslog
rsyslog ships as the default syslog daemon on RHEL and many other distributions, so there’s a good chance it’s already running on your servers.
One recent change: Debian dropped rsyslog from its default install in Debian 12 in favor of systemd-journald alone.
Running apt install rsyslog brings it back.
It’s fast, modular, and can buffer to disk when configured to.
The trade-offs: configuration spans two syntax dialects (legacy and RainerScript), it’s Linux-only in practice, and there’s no viewer.
syslog-ng OSE
syslog-ng Open Source Edition offers a readable configuration language and strong parsing and filtering, under a combined LGPLv2.1 (core) and GPLv2 license. Like rsyslog, it’s a first-class citizen on Linux and Unix. There’s no Windows agent in the open-source edition and no viewer.
Graylog Open
Graylog Open is the closest thing to a complete free product on this list: syslog inputs, indexed search, dashboards, and alerting in a web UI, self-managed at no cost. Two things to weigh. First, since version 4.0 it’s licensed under the Server Side Public License, which Graylog itself notes is not OSI-approved - "source-available" is the accurate label. Second, you’re operating a stack that includes MongoDB and OpenSearch, which is a real infrastructure commitment for a logging tool.
Kiwi Syslog Server Free Edition
SolarWinds' Kiwi Syslog Server Free Edition is the fastest way to get a syslog GUI on a Windows box, and it handles SNMP traps too. Per SolarWinds' own documentation, the free edition accepts messages from up to five sources - enough for a small site or a lab; the paid edition removes the cap. Check the product line before you standardize on it, though: the legacy Kiwi Syslog Server reached end of service life on March 28, 2026, and Kiwi Syslog Server NG is the current release.
Visual Syslog Server
Visual Syslog Server is a tiny open-source Windows app that starts listening on UDP and TCP 514 the moment you install it, with live message view, color highlighting, and filtering. It only understands RFC 3164, has no TLS transport, and its listed OS support ends at Windows 8.1 and Server 2012, with no recent releases. Keep it on the bench for ad-hoc troubleshooting - not on your production network edge.
How to set up a free syslog server with NXLog
The configurations below run on NXLog Agent, the collector included in the NXLog Platform Free plan.
Step 1: Install NXLog Agent
Sign up for NXLog Platform Free, deploy the on-premises instance, and enroll an NXLog Agent on a host to receive syslog - the documentation covers both steps.
Apply the configurations below from NXLog Platform’s central agent management, or open nxlog.conf in the agent’s configuration directory.
Step 2: Receive syslog over UDP
This configuration listens on UDP port 514, parses each message, and writes the result to a file:
<Extension syslog>
Module xm_syslog
</Extension>
<Input syslog_udp>
Module im_udp
ListenAddr 0.0.0.0:514
Exec parse_syslog();
</Input>
<Output central_file>
Module om_file
File '/var/log/central/syslog.log'
</Output>
<Route syslog_to_file>
Path syslog_udp => central_file
</Route>The UDP input module handles the transport, and parse_syslog() from the Syslog extension parses both BSD and IETF formats.
See the syslog parsing guide for per-format examples.
One practical note: on Linux, binding a port below 1024 requires root privileges, so many deployments listen on a high port such as 1514 instead. Windows doesn’t restrict low ports.
Step 3: Add a TCP listener
TCP removes the silent packet loss that comes with UDP:
<Input syslog_tcp>
Module im_tcp
ListenAddr 0.0.0.0:1514
Exec parse_syslog();
</Input>By default, this expects newline-delimited messages.
For senders that use octet-counted framing, add InputType Syslog_TLS - the framing reader that the Syslog extension provides for RFC 5425-style transport, which also works over plain TCP.
Step 4: Accept TLS syslog on port 6514
Encrypted transport is where several free tools drop out. NXLog handles it with the TLS/SSL input module:
define CERTDIR /path/to/certs
<Input syslog_tls>
Module im_ssl
ListenAddr 0.0.0.0:6514
CAFile %CERTDIR%/ca.pem
CertFile %CERTDIR%/agent-cert.pem
CertKeyFile %CERTDIR%/agent-key.pem
InputType Syslog_TLS
Exec parse_syslog();
</Input>Point your senders at port 6514 with the same CA, and your log transport is encrypted and authenticated per RFC 5425.
Step 5: Send a test message
From any Linux host, logger tests the whole pipeline, from sender to output file:
$ logger --udp --server 127.0.0.1 --port 514 "Test message from logger"
$ tail -n 1 /var/log/central/syslog.logIf the parsed message appears in the output file, your free syslog server is live.
Bonus: Turn Windows events into syslog messages
Windows doesn’t speak syslog natively. NXLog Agent reads Windows Event Log directly and converts each record to syslog - the one job the Linux-only daemons can’t do. This agent configuration collects logon successes and failures from the Security log and forwards them as IETF syslog:
<Extension syslog>
Module xm_syslog
</Extension>
<Input windows_security>
Module im_msvistalog
<QueryXML>
<QueryList>
<Query Id="0">
<Select Path="Security">*[System[(EventID=4624 or EventID=4625)]]</Select>
</Query>
</QueryList>
</QueryXML>
</Input>
<Output syslog_server>
Module om_tcp
Host collector.example.com:1514
Exec to_syslog_ietf();
</Output>
<Route windows_to_syslog_server>
Path windows_security => syslog_server
</Route>The same mechanism powers Windows Event Log collection at scale, including the RDP session auditing covered in the Remote Desktop logs guide.
Viewing syslog data: free syslog viewer options
A syslog viewer is any interface that lets you read, filter, and search collected messages. The options range from a terminal to an indexed web UI.
- Command line
-
tail -fandgrepare where everyone starts. For local systemd journals, journalctl adds filtering by unit, priority, and time. lnav is a step up for flat files: it detects syslog formats, colorizes, and filters interactively without any server component. - Visual Syslog Server
-
Gives you a live Windows view in about a minute - with the RFC 3164-only and no-TLS caveats covered above. Good for watching a device while you configure it.
- Kiwi Syslog Server Free Edition
-
Adds display rules and basic alerting in its Windows GUI, within the five-source limit.
- Graylog Open
-
A genuine indexed search experience - if you’re willing to run its database stack.
- NXLog Platform Free
-
Includes search and dashboards across everything your agents collect, without a separate database deployment, on the same free plan that manages the agents.
Whichever you pick, the viewer is usually where flat-file logging shows its age first: no index, no retention policy, and no access control.
Limitations of free syslog servers
Every tool above solves a real problem. Here’s where each one stops.
- UDP loses messages silently
-
RFC 5426 states plainly that the UDP transport provides no delivery guarantee, and the sender never learns a message was dropped. Since most devices default to UDP, assume gaps until you’ve moved anything you’d miss to TCP or TLS.
- Delivery guarantees take deliberate work
-
rsyslog and syslog-ng can buffer to disk when a destination stalls, but you have to configure it - default in-memory queues lose data under pressure or on restart. The simpler GUI tools have nothing comparable.
- Windows stays dark without an agent
-
The pure-Linux daemons can’t read Windows Event Log - often the largest single source of security logs in an organization. You need an agent that converts and forwards, as shown in the setup section above.
- No one watches the collector
-
Free tools have no central view of collector health or configuration. At a handful of hosts you’ll cope; at fifty, configurations drift, and a dead listener produces exactly the same output as a quiet, healthy network: silence.
- Flat files aren’t a viewer
-
grepacross months of multi-gigabyte files is slow, there’s no retention policy beyond a cron job, and there’s no way to give an analyst read access without giving them the box. - Compliance asks for more than collection
-
PCI DSS v4 Requirement 10.5.1 requires "retaining audit log history for at least 12 months, with the most recent three months immediately available". See the standard in the PCI SSC document library and our PCI DSS logging guide. NIST’s Guide to Computer Security Log Management (SP 800-92, 2006) adds expectations around log protection and defined retention. Auditors also ask how logs are encrypted in transit and who can access them - questions a directory of flat files answers badly.
- Maintenance status is a security property
-
A syslog receiver sits on your network and parses untrusted input, so its patch cadence matters. On this list, Visual Syslog Server is dormant, and the legacy Kiwi Syslog Server has been past its end-of-service life since March 2026. Factor that in before putting either on a network edge.
When to upgrade: a decision checklist
Free is the right answer more often than vendors admit. Check every line that applies:
-
You collect from more than 10 sources - beyond the NXLog Platform Free plan - or more than five, beyond Kiwi Free.
-
A compliance framework applies to you (PCI DSS, HIPAA, ISO 27001, SOC 2), with retention and access requirements you’d have to defend.
-
You need TLS with real certificate management across the fleet, not a one-off keypair.
-
Windows or macOS hosts are in scope, not only Linux.
-
You need to know within minutes when a source stops sending - not at the next incident.
-
People other than you need to search logs, with access control.
-
Searching currently takes longer than the incidents do.
Two or more checked boxes and it’s time to look at managed log collection. Zero checked boxes - a lab, a handful of Linux hosts - and a free daemon plus discipline is a perfectly good answer. We’d rather tell you that than sell you something you don’t need.
Upgrading without ripping everything out: NXLog Platform
NXLog Platform adds the parts no free syslog server provides: central agent enrollment and configuration, fleet health monitoring, and built-in log storage with search. The current NXLog Agent covers more than 40 platform/architecture combinations and 120+ modules. It runs on-premises, so your logs stay in your environment. The documentation walks through deployment and agent enrollment.
Pricing follows source count, not data volume - licensing is per source, with no per-gigabyte ingestion charges, so a chatty firewall doesn’t blow up your bill. And because the Free plan is the same product limited only by source count, "upgrading" is a plan change rather than a migration. Start free with up to 10 sources, or take the 30-day Premium trial - unlimited sources while it runs, no credit card required.
Where this leaves you
-
Free syslog servers handle collection well. The gaps are viewers, Windows coverage, delivery guarantees, and fleet management - and they surface at the worst times.
-
Match the tool to the job: rsyslog or syslog-ng OSE on Linux estates, the NXLog Platform Free plan when Windows is in scope, and the GUI tools for quick, small-scale viewing.
-
UDP drops messages silently. Move anything you’d miss to TCP, and preferably TLS on port 6514.
-
Compliance retention - 12 months under PCI DSS - is where flat files and
grepstop being defensible. -
Free NXLog is the NXLog Platform Free plan: 10 sources, full features, and upgrading is a plan change rather than a migration.
Start with a free syslog server; just decide in advance which checklist item will trigger the upgrade, so the decision is yours and not an auditor’s. If you want the free tier and the upgrade path in the same product, NXLog Platform Free is built for exactly that.
FAQ
- What is the best free syslog server for Windows?
-
For collecting Windows logs, use an agent that reads Windows Event Log natively and converts it to syslog - NXLog Agent on the NXLog Platform Free plan does this. Kiwi Free and Visual Syslog Server are Windows receivers with a GUI, but they’re limited to five sources and RFC 3164, respectively.
- What port does a syslog server use?
-
UDP port 514 is the traditional default (RFC 5426). Plain TCP commonly uses 514 or 1514 by convention (RFC 6587). Syslog over TLS uses port 6514, assigned by RFC 5425 - the transport to prefer for anything sensitive.
- Is NXLog Platform free?
-
Yes. The NXLog Platform Free plan includes the current NXLog Agent, agent management, and log search for up to 10 sources, with no feature limits. Past 10 sources, pricing is per source, not per gigabyte.
- What’s the difference between a syslog server and a SIEM?
-
A syslog server collects, parses, and stores log messages. A SIEM sits on top of collected logs and adds correlation rules, detection content, alerting, and case management. Most SIEM deployments ingest from syslog infrastructure rather than replacing it - you’ll usually run both.
- Can Windows events be sent to a syslog server?
-
Yes, with an agent. NXLog Agent reads channels through its Windows Event Log module and converts records with the Syslog extension, as shown in the configuration above. Windows Event Forwarding can pre-aggregate events, but you still need a converter to produce syslog for downstream tools.
- How long should syslog logs be retained?
-
It depends on your obligations. PCI DSS v4 Requirement 10.5.1 sets the clearest bar: at least 12 months of history, with the most recent three months immediately available. Without a mandate, set retention deliberately by log category and incident-response lookback needs - NIST SP 800-92 is the reference for building that policy, with a Revision 1 draft in progress since 2023.
