Running Syslog-NG on Windows

This post describes running syslog-ng as a server on Windows.  In another post, we describe how to send Windows Event Logs to syslog.

There are many great commercial syslog servers for Windows.  There are not many options for those looking for a free alternative.  One option is Aonaware.  Another option is to install syslog-ng through cygwin.  Cygwin is a Linux-like environment run inside a windows command shell.  Cygwin runs on all current desktop and server versions of Windows.  In this post, we will walk through setting up syslog-ng on a windows host.

  1. First, visit the Cygwin website to download the setup.exe application.  Save, then run setup.exe.
  2. Choose “Install From Internet”
  3. Select the directory to install into and the user to install for (leave this as “all users”).
  4. Enter the directory for local packages. Accepting the default location is fine.
  5. Choose your Internet connection type (direct or proxy)
  6. Select a site to download from.  Any one should be fine.
  7. At the “install packages” window, type is “syslog” in the search box.  You will see “Admin” below.  Expand the admin section, and you will see syslog-ng.  Click the word “skip” until you see 3.0.1 (or whatever the latest supported version is).
  8. Also choose the following packages:
    1. Admin/cygrunsrv
    2. Editors/VIM
    3. Gnome/glib
  9. Finish the installation.

Now, launch the Cygwin shell from the start menu.  Be sure to right click and “run as administrator”.  First, run the command “/bin/syslog-ng-config” to create the config file.  Answer “yes” to the question on installing syslog-ng as a service

We can now edit and customize the syslog-ng config file, located in /etc/syslog-ng.conf.  By default, the config contains the following:

$ less /etc/syslog-ng.conf
@version: 3.0
options {
keep_hostname(yes);
owner(“system”);
group(“root”);
perm(0664);
flush_lines(0);
};
source applications {
unix-dgram(“/dev/log”);
internal();
};
source kernel {
file(“/dev/kmsg”, program_override(“kernel: “));
};
destination messages {
file(“/var/log/messages”);
};
log {
source(applications);  destination(messages);
};
log {
source(kernel);
destination(messages);
};

A new service called “CYGWIN syslog-ng” is now registered in Windows and appears in the list of services in the Windows control panel.  To start the syslog-ng service from the cygwin command line, run the following command:

cygrunsrv -S syslog-ng

Now, we have a fully functional instance of syslog-ng running on our Windows system.