Agent to forward Windows event logs as syslog messages to a remote syslog server.
Switch branches/tags
Nothing to show
Clone or download
Pull request Compare This branch is 1 commit ahead of fmikker:master.
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Type Name Latest commit message Commit time
Failed to load latest commit information.
Datagram SyslogAgent manual.pdf


Note This repository is only available for historical reasons and the application is not maintained.

Feel free to fork the application and use it according to the LICENSE. If you are interested in taking over the project and maintain it, file an issue on Github.

SyslogAgent is a Windows add-on, allowing Windows EventLog events as well as other Windows applications logs to be sent to a syslog server. SyslogAgent is installed as a transparant service on Windows.

The SyslogAgent is a derivate of NTSyslog by, and is shipped under the GNU license. Therefore, the software is freely downloadable and free to use. The application logging functionality of SyslogAgent handles any logs that are text-based and uses one line per log entry. A wizard functionality suggests which configuration to use, or the user can manually configure the mapping from log file to syslog format. Most common logging formats on Windows (IIS, FTP etc) are automatically supported.


SyslogAgent has been significantly optimized compared to NTSyslog. Changes in the engine has resultet in several orders of magnitude faster parsing, which was needed for large volume installations. Communication with domain servers has also be minimized. Filtering based on EventIDs has also been introduced.

SyslogAgent has a security feature agains loss of data because of network availability. SyslogAgent will not transmit any logs when a reliable network connection to the SyslogServer is unavailable. When it does become available, all the accumulated event logs are transmitted. This feature is designed primarily for laptops, but is also to an advantage in an enterprise environment in case of network connectivity problems, or SyslogServer downtime.