# Can syslog store logs in a database instead of files?



## mr123 (Jan 30, 2021)

Is it possible for FreeBSD's syslog to store log entries inside a database (e.g. SQLite or PostgreSQL) instead of in plain text files? Or must I replace FreeBSD's syslog with another syslog implementation that supports storing log entries inside a database?


----------



## SirDice (Jan 31, 2021)

mr123 said:


> Is it possible for FreeBSD's syslog to store log entries inside a database (e.g. SQLite or PostgreSQL) instead of in plain text files?


No.


mr123 said:


> Or must I replace FreeBSD's syslog with another syslog implementation that supports storing log entries inside a database?


Yes.


----------



## Mjölnir (Jan 31, 2021)

Try `pkg install psearch portell`, then `psearch -c sysutils -s syslog` and then `portell syslog-ng`.  _Et voilà!  There's gold in them thar networks..._


----------



## SirDice (Jan 31, 2021)

Note that support for various databases is off by default on sysutils/syslog-ng. So the package doesn't have them enabled.


```
MONGO=off: MongoDB support
REDIS=off: Build with Redis support
SQL=off: Build with database (libdbi) support
```

sysutls/rsyslog8 (commonly used on RHEL and variants) is also an alternative but that also has all database support off by default:

```
DBI=off: LibDBI output module for rsyslog
ELASTIC=off: Elasticsearch module for rsyslog
MYSQL=off: MySQL output module for rsyslog
PGSQL=off: PostgreSQL output module for rsyslog
```


----------



## mr123 (Feb 1, 2021)

SirDice said:


> Note that support for various databases is off by default on sysutils/syslog-ng. So the package doesn't have them enabled.


Does this mean that it is necessary to build from source in order to enable support for saving into databases?


----------



## SirDice (Feb 1, 2021)

mr123 said:


> Does this mean that it is necessary to build from source in order to enable support for saving into databases?


Build from ports, yes.


----------



## Mjölnir (Feb 1, 2021)

But don't mix ports from _latest_ with packages from _quarterly_!


----------

