Topic starter
19/08/2026 3:25 pm
TL;DR: RELP can be used to keep existing rsyslog collectors in place while shifting parsing, normalisation, enrichment, and routing into a programmable security data pipeline, reducing the need to rebuild long-lived logging estates from scratch, according to TENZIR. The key issue is not transport alone but where reliability ends and downstream processing begins, which changes how teams think about log delivery and backpressure.
Editorial analysis by NHI Mgmt Group, based on content published by TENZIR: “Don't rip out rsyslog. Point it at Tenzir.”.
Key questions
Q: How should security teams modernise Syslog logging without rebuilding their collectors?
A: Keep the existing collection layer and move transformation into the pipeline.
Q: Why does RELP improve reliability without making log delivery end-to-end durable?
A: RELP confirms that the receiving pipeline accepted a transaction, but it does not guarantee that every downstream destination stored it.
Q: What breaks when Syslog collectors are replaced too early?
A: Teams lose mature local controls such as routing rules, queues, certificate handling and retry behaviour that have already been tuned for the environment.
Practitioner guidance
- Preserve the collector layer Keep rsyslog at the edge and point omrelp to a downstream receiving node instead of rebuilding the estate around the new pipeline.
- Define the acknowledgement boundary Document that RELP confirms handoff into the receiving pipeline, not end-to-end persistence across every downstream destination.
- Retain queue durability on the sender Use disk-assisted queues, queue filenames and shutdown persistence so brief outages do not erase events before retransmission.
Bottom line: RELP shifts the logging problem from raw delivery to where handoff ends and downstream processing begins, which is a governance decision as much as a technical one.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
19/08/2026 4:10 pm
Transport reliability is now part of security governance, not just plumbing. In logging estates, the control question is no longer whether messages leave the box, but what reliability contract the collector actually provides to downstream security systems. If that contract is vague, teams either over-couple edge collectors to every destination or accept avoidable blind spots. Practitioners should define the acknowledgement boundary before they redesign the pipeline.
A question worth separating out:
Q: What should security teams do when a log pipeline crosses trust zones?
A: Use authenticated transport, preserve source metadata, and separate the acknowledgement of receipt from the downstream storage guarantee. That keeps the transport boundary clear while still letting security data flow across sites, business units or customer environments with controlled retry behaviour.
👉 Read our full editorial: RELP lets security teams modernise Syslog without replacing collectors