Structured syslog for embedded and industrial systems.

The security audit trail your product needs for IEC 62443 and the EU Cyber Resilience Act — a fully tested, standards-compliant syslog implementation, ready to build into your product.

Explore the documentation Talk to us about your product →

Free to evaluate — and open on GitHub.

Connected products now have to prove what happened on them

Regulation is converging on one expectation: a device must keep a trustworthy record of its security-relevant events. IEC 62443 asks it of industrial products and the systems built from them. The EU Cyber Resilience Act makes it a condition of placing a product on the European market. NIS2 pushes the same duty onto the operators who deploy those products — and they increasingly require it of their suppliers.

None of these frameworks names a protocol. But on an embedded device, syslog is the established way to produce that audit trail: a proven, universally understood format that every SIEM already ingests, far lighter to add to a product than the alternatives, and exactly what an assessor expects to see.

SolidSyslog gives you that as a component you drop in, not a subsystem you invent — a fully tested, scalable, standards-compliant syslog implementation you can add to an existing product or design into a new one, rapidly and without building it yourself.

What SolidSyslog does

It records a security event inside your device, stamps it with trusted metadata, holds it safely if the network drops, and delivers it to any central log server over TLS — in the standard, structured syslog format that every SIEM already understands.

SolidSyslog runs inside your product. The pink tags are the seams where it fits around what you already run — your OS, filesystem, network stack and TLS library — so Core never changes.

It runs from small networked microcontrollers up to Linux and Windows hosts, needs no dynamically allocated memory, and asks for nothing it can avoid: omit a capability and a built-in null object stands in, at no cost. It is built on the established syslog standards — the RFC compliance matrix sets out exactly what it implements.

Right-sized to your Security Level

You don’t buy a tier. You wire the handful of components your deployment actually needs — and a capability you don’t need costs nothing. As the demands of IEC 62443 rise, the same library scales with them; the component-by-Security-Level guide walks through each step.

Level	The attacker in scope	What a SolidSyslog deployment adds
SL1	Casual or accidental	A valid, timestamped RFC 5424 record, delivered to your collector and kept readable.
SL2	Simple, intentional	Trusted-time metadata, gap-visible delivery, a protected and authenticated TLS channel, and store-and-forward survival across outages.
SL3	Sophisticated, IACS-aware	Authenticated provenance and gap detection (mutual TLS and sequence IDs), tamper-evident at-rest integrity, and per-device identity.
SL3+	State-level	The same evidence, hardened: write-once storage, a protected time source, and keys held in hardware.

IEC 62443 certifies systems, not components, and a Security Level is a property of your whole system and its assessment. This is our best guidance on how SolidSyslog helps with the audit-logging controls, not a guarantee of compliance. The component-by-Security-Level guide and the control-by-control map have the detail.

From the smallest networked devices upward

The same Core runs on a small networked microcontroller and on a Linux gateway. Written in C99 with no dynamically allocated memory, dependency-injected throughout, and MISRA C:2012 informed, it scales across your product range without a different codebase. The platforms guide shows what runs where.

Why SolidSyslog

Fits your product

Porting SolidSyslog is filling roles, not editing Core: supply an adapter for a platform we don’t ship yet, or omit one and its null object stands in. Reference adapters already ship for FreeRTOS, lwIP and FreeRTOS-Plus-TCP, Mbed TLS and OpenSSL, ChaN FatFs, POSIX and Windows — and the list is growing. Logging is as simple as SolidSyslog_Log(); servicing the secure storage and network is as simple as SolidSyslog_Service(). The getting-started guide has the capability matrix, both integration paths, and a first-log walkthrough.

Try it, then licence it

SolidSyslog is feature-complete, with comprehensive automated test coverage across every supported platform, and ready to trial today. The 0.1.0 release lands in August 2026, and version 1.0.0 follows in Q4 2026.

It is free to evaluate, and free for non-commercial, personal, educational and government use under the PolyForm Noncommercial License. Shipping it inside a commercial product needs a commercial licence, which we tailor to your product, the platforms you target, and the support you need. If you are working to a compliance deadline, talk to us early — we will help you fit it into your roadmap, including additional platforms and integration support.

Explore the documentation Start a licensing conversation →