Sloggo: The Lightweight Syslog Collector for Modern Developers

Introduction

Managing logs efficiently is a critical task for any developer, especially when dealing with small to medium-sized setups that require real-time log monitoring without the overhead of heavy resources. Traditional log management solutions often come with significant resource consumption and complex configurations. This is where Sloggo steps in, offering a lightweight, resource-friendly syslog collector and viewer based on DuckDB. In this article, we'll explore what Sloggo is, its key features, how to set it up, and why it stands out in the world of log management.

What is Sloggo?

Sloggo is a minimal RFC 5424 syslog collector and viewer built on top of DuckDB. Developed by Phare, a small bootstrapped company known for creating high-quality uptime monitoring and alerting tools, Sloggo is designed to be both lightweight and efficient. It runs as a single process, consuming minimal resources and offering quick configuration via environment variables. The tool is less than 10 MiB in compressed size, making it an ideal solution for environments where resource usage is a concern.

Sloggo ingests logs over TCP and UDP using the RFC 5424 Syslog protocol, stores them in DuckDB, and presents them in a clean, modern web UI. It is particularly suited for setups that need real-time logs without the complexity of spinning up a full Kubernetes cluster or running a JVM. Despite its lightweight nature, Sloggo offers impressive performance, capable of ingesting up to 1 million logs per second.

Currently in alpha release, Sloggo is not yet recommended for critical or sensitive data. It lacks a security layer by default and is best used within a private network or behind a secure reverse proxy.

Key Features

Lightweight and Efficient

Sloggo is designed to run as a single process, consuming minimal resources. This makes it ideal for environments where resource usage is a concern. Its small footprint and efficient design ensure that it can be easily deployed without significant overhead.

Fast Log Ingestion and Search

With the ability to ingest up to 1 million logs per second, Sloggo offers impressive performance. Its fast search, filtering, and tailing capabilities ensure that you can quickly find and analyze the logs you need.

Easy Configuration

Sloggo can be quickly configured using environment variables. This makes it easy to set up and deploy, even for those who are not deeply familiar with log management systems.

Modern Web UI

Sloggo presents logs in a clean, modern web UI built with data-table-filters. This makes it easy to navigate and explore your logs, providing a user-friendly experience.

Zero Configuration

Sloggo is designed to work out of the box with zero configuration. This means you can start using it immediately without needing to spend time setting up complex configurations.

Use Cases

Small to Medium-Sized Log Management

Sloggo is perfect for small to medium-sized setups that need real-time log monitoring without the overhead of heavy resources. Its lightweight nature and efficient design make it an ideal solution for environments where resource usage is a concern.

Real-Time Log Monitoring

With its fast log ingestion and search capabilities, Sloggo is ideal for real-time log monitoring. You can quickly find and analyze the logs you need, making it easier to identify and resolve issues.

Resource-Constrained Environments

Sloggo's lightweight design and minimal resource consumption make it suitable for resource-constrained environments. It can be easily deployed without significant overhead, making it an ideal solution for environments where resources are limited.

Quick Log Exploration

Sloggo's modern web UI and fast search capabilities make it easy to explore and analyze your logs. You can quickly find the information you need, making it easier to identify and resolve issues.

Step-by-Step Installation & Setup Guide

Prerequisites

Docker or Podman installed on your system
Basic understanding of syslog and log management

Installation Steps

Start the Container

Use Docker or Podman to start the Sloggo container. Here is the complete command to get started:

docker run --name sloggo \
   -p 5514:5514/udp -p 6514:6514 -p 8080:8080 \
   -e SLOGGO_LISTENERS=tcp,udp \
   -e SLOGGO_UDP_PORT=5514 \
   -e SLOGGO_TCP_PORT=6514 \
   -e SLOGGO_API_PORT=8080 \
   -v ./data:/app/.duckdb \
   ghcr.io/phare/sloggo:latest

Send Some Logs

Once the container is running, you can start sending logs to Sloggo. Here is an example command to send a log message:
```
echo "<34>1 2025-08-04T12:00:00Z myhost sloggo - - - Hello, Sloggo" | nc localhost 6514
```
Access the Application
- Frontend: http://localhost:8080/
- Health check endpoint: http://localhost:8080/api/health

Environment Variables

You can configure Sloggo using the following environment variables:

SLOGGO_LISTENERS: Comma-separated list of listeners to enable (default: tcp,udp).
SLOGGO_UDP_PORT: Port for the UDP Syslog listener (default: 5514).
SLOGGO_TCP_PORT: Port for the TCP Syslog listener (default: 6514).
SLOGGO_API_PORT: Port for the API (default: 8080).
SLOGGO_LOG_RETENTION_MINUTES: Duration in minutes to keep logs before deletion (default: 43200 - 30 days).
SLOGGO_LOG_FORMAT: Log parsing format (default: auto). Supported values:
- auto: Try RFC 5424 first, then fall back to RFC 3164.
- RFC5424: Only parse messages as RFC 5424.
- RFC3164: Only parse messages as RFC 3164.

REAL Code Examples from the Repository

Example 1: Starting the Sloggo Container

Here is a complete example of how to start the Sloggo container using Docker:

# Start the Sloggo container with Docker
docker run --name sloggo \
   -p 5514:5514/udp -p 6514:6514 -p 8080:8080 \
   -e SLOGGO_LISTENERS=tcp,udp \
   -e SLOGGO_UDP_PORT=5514 \
   -e SLOGGO_TCP_PORT=6514 \
   -e SLOGGO_API_PORT=8080 \
   -v ./data:/app/.duckdb \
   ghcr.io/phare/sloggo:latest

This command starts the Sloggo container with the specified ports and environment variables. The -v ./data:/app/.duckdb option mounts a local directory to store the DuckDB database.

Example 2: Sending Logs to Sloggo

Once the container is running, you can send logs to Sloggo using the following command:

# Send a log message to Sloggo
echo "<34>1 2025-08-04T12:00:00Z myhost sloggo - - - Hello, Sloggo" | nc localhost 6514

This command sends a syslog message to the Sloggo TCP listener on port 6514. The message is formatted according to the RFC 5424 standard.

Example 3: Accessing the Sloggo Web UI

You can access the Sloggo web UI by navigating to the following URL in your browser:

http://localhost:8080/

The web UI provides a clean and modern interface for exploring and analyzing your logs. You can use the various filters and search options to quickly find the information you need.

Example 4: Checking the Health Endpoint

Sloggo provides a health check endpoint that you can use to verify that the service is running correctly. Access the endpoint using the following URL:

http://localhost:8080/api/health

This endpoint returns a JSON response indicating the status of the Sloggo service.

Advanced Usage & Best Practices

Optimizing Log Ingestion

To optimize log ingestion, ensure that your network configuration allows for efficient communication between your log sources and the Sloggo service. Avoid unnecessary network hops and use dedicated network interfaces if possible.

Managing Log Retention

Sloggo allows you to configure log retention using the SLOGGO_LOG_RETENTION_MINUTES environment variable. Set this value according to your storage capacity and log analysis requirements.

Using Environment Variables for Configuration

Sloggo can be configured using environment variables, making it easy to manage settings without modifying configuration files. Use this feature to simplify deployment and management.

Running in a Private Network

Since Sloggo does not offer a security layer by default, it is recommended to run it within a private network or behind a secure reverse proxy. This ensures that your logs are protected and only accessible to authorized users.

Comparison with Alternatives

Why Choose Sloggo?

Feature	Sloggo	ELK Stack	Loki	Datadog
Lightweight	Yes	No	No	No
Resource-Friendly	Yes	No	No	No
Easy Setup	Yes	Complex	Complex	Complex
Real-Time Logs	Yes	Yes	Yes	Yes
High Ingestion Rate	Yes	Yes	Yes	Yes
Security Layer	No	Yes	Yes	Yes
Long-Term Storage	No	Yes	Yes	Yes

Sloggo stands out as a lightweight, resource-friendly solution for small to medium-sized setups. While it lacks some advanced features found in ELK Stack, Loki, and Datadog, it offers a simple and efficient way to manage logs without the complexity and resource consumption of these alternatives.

FAQ

Is Sloggo production-ready?

Sloggo is currently in alpha release and is not yet recommended for production use. It lacks a security layer and is best used within a private network or behind a secure reverse proxy.

Can Sloggo handle large volumes of logs?

Yes, Sloggo is capable of ingesting up to 1 million logs per second, making it suitable for environments with high log volumes.

How do I configure Sloggo?

Sloggo can be configured using environment variables. See the documentation for a list of available variables and configuration options.

Is Sloggo secure?

Sloggo does not offer a security layer by default. It is recommended to run it within a private network or behind a secure reverse proxy to protect your logs.

Can I contribute to Sloggo?

Yes, contributions are welcome! Fork the repository and submit a pull request with your changes.

What is the license for Sloggo?

Sloggo is licensed under the MIT License. See the LICENSE file for details.

Conclusion

Sloggo is a revolutionary tool for developers looking for a lightweight, resource-friendly syslog collector and viewer. Its minimal design, fast log ingestion, and modern web UI make it an ideal solution for small to medium-sized setups. While it may not replace full-fledged log management systems like ELK Stack, Loki, or Datadog, it offers a simple and efficient way to manage logs without the complexity and resource consumption of these alternatives.

If you're looking for a lightweight and efficient syslog collector, give Sloggo a try. Visit the GitHub repository to learn more and get started today!