StatusPal
StatusPal Next is pulling ahead as the real product while Classic slips into maintenance mode.
Comparison · Infra & APIs
rsyslog vs werf
A side-by-side editorial comparison of rsyslog and werf — release velocity, themes, recent moves, and the top alternatives to consider.
Shared themes:kubernetes
rsyslog vs werf: at a glance
What is rsyslog?
The syslog daemon on every Linux box now collects Kubernetes logs itself
rsyslog's August scheduled-stable snapshot adds imkubernetes, an input module that tails pod and container logs directly, handles CRI and Docker json-file records, merges partial CRI lines, and enriches from the Kubernetes API. It lands alongside a segmented disk-assisted queue engine that becomes the default for new stores, a CloudWatch Logs output module, and generic per-action rate limiting in drop or pace mode.
What is werf?
werf v3 adds authenticated secrets and netavark while v2 alpha ships incremental fixes
werf maintains dual release tracks: v2 alpha for stable users and v3 dev where substantive changes land first. v3.3.0 introduced authenticated secret values in deploy and renderPatches support; v3.4.0 migrated the build networking layer from CNI/slirp4netns to netavark. The v2 alpha track absorbed several targeted fixes including a build layer re-compression regression stop and a deploy panic guard.
rsyslog vs werf: editorial side-by-side
rsyslog
3.8INFRA · APIS
The syslog daemon on every Linux box now collects Kubernetes logs itself
◆ Current state
rsyslog's August scheduled-stable snapshot adds imkubernetes, an input module that tails pod and container logs directly, handles CRI and Docker json-file records, merges partial CRI lines, and enriches from the Kubernetes API. It lands alongside a segmented disk-assisted queue engine that becomes the default for new stores, a CloudWatch Logs output module, and generic per-action rate limiting in drop or pace mode.
◆ Where it's heading
Three consecutive snapshots have pushed rsyslog out of its role as a local relay and toward being a full pipeline component: YAML config and native OpenTelemetry protobuf in April, an Elastic Beats input in June, a Kubernetes-native input now. The queue rewrite and rate limiting point at the same target, since those are the properties an edge collector needs to survive backpressure rather than what a syslog relay needs.
◆ Prediction
Expect the next snapshot to harden imkubernetes against the operational cases the notes already hedge on, particularly ServiceAccount token refresh and API failover, and to push more deployments onto segmented queues by default.
werf
5.0INFRA · APIS
werf v3 adds authenticated secrets and netavark while v2 alpha ships incremental fixes
◆ Current state
werf maintains dual release tracks: v2 alpha for stable users and v3 dev where substantive changes land first. v3.3.0 introduced authenticated secret values in deploy and renderPatches support; v3.4.0 migrated the build networking layer from CNI/slirp4netns to netavark. The v2 alpha track absorbed several targeted fixes including a build layer re-compression regression stop and a deploy panic guard.
◆ Where it's heading
The v3 dev track is accumulating features that point toward a more complete GitOps/Helm-native pipeline: authenticated secrets for vault integration, renderPatches for deploy customization, and an embedded Deno binary (v3.2.0) for scripting. The netavark networking requirement in v3.4.0 is a breaking infrastructure dependency change that suggests v3 is hardening toward a stable release.
◆ Prediction
The authenticated secret values feature in v3.3.0 will expand to cover additional secret backends, and the Deno integration will likely gain more scripting surface for deploy hooks before v3 reaches stable.
Alternatives to rsyslog and werf
Other Infra & APIs products tracked by Sparkpulse, ranked by recent ship velocity. Each card links to a full editorial trajectory and lets you pivot into a head-to-head comparison with either rsyslog or werf.
Parse Server
Parse Server 9.10.1 is a rolling security audit: nine consecutive alpha patches for auth bypasses and data leaks.
Infisical
Infisical ships Agent Vault to GA and light mode while deprecating Gateway v1
incident.io
incident.io Investigations doubles speed: 68% of incidents get accurate RCA in under 5 minutes
Redocly
Redocly ships MCP server infrastructure across its full product line while Reunite iterates on PR workflow details
CircleCI
CircleCI bets on GitHub Actions YAML portability while hitting GA on self-hosted runner autoscaling
See all rsyslog alternatives → · See all werf alternatives →
Recent activity from rsyslog and werf
Latest ship moves from both products, interleaved chronologically. ⚡ = editorial spark.
- 13h agowerfwerf 2.79.0: build reports include version; deploy returns rendered resources
- 12d agowerfFix: stop re-compressing parent layers on stage push
- 13d agowerfwerf v3.4.0: builds now require netavark, dropping CNI/slirp4netns
- 13d agowerfFix: stage builds no longer depend on stapel image cat
- 14d agowerfFix: host-cleanup reports freed space from actual disk state
- 21d agowerfwerf v3.3.0: authenticated secrets in deploy and renderPatches support
- 1mo agorsyslogrsyslog 8.2608.0 adds a Kubernetes log input and segmented disk queues ⚡
- 2mo agorsyslogrsyslog 8.2606.0 adds Elastic Beats input and TCP compression
- 5mo agorsyslogrsyslog 8.2604.0 adds YAML config and native OTel protobuf ⚡
- 7mo agorsyslogrsyslog 8.2602.0 tag with no release notes
- 9mo agorsyslogMarker tag for the AGENTS.md doc state at end of 2025
- 9mo agorsyslogrsyslog 8.2512.0 tag with no release notes
Frequently asked questions
What is the difference between rsyslog and werf?
Both compete on the same themes — kubernetes — within Infra & APIs. werf is currently shipping more aggressively (velocity 5.0 vs 3.8), with 0 editorial sparks in the last 30 days against 0. See the at-a-glance table above for a side-by-side breakdown of velocity, recent sparks, and editorial themes.
Is rsyslog better than werf?
Sparkpulse doesn't pick a winner — we score release velocity, not feature parity. werf is currently shipping more aggressively (velocity 5.0 vs 3.8), with 0 editorial sparks in the last 30 days against 0. For your specific use case, the alternatives sections above list other Infra & APIs products to evaluate alongside.
What are the best alternatives to rsyslog?
Top rsyslog alternatives in Infra & APIs are ranked by recent ship velocity. Browse the "rsyslog alternatives" section above for the current picks, or visit /alternatives/rsyslog for the full list with editorial commentary on each.
What are the best alternatives to werf?
Top werf alternatives in Infra & APIs are ranked by recent ship velocity. Browse the "werf alternatives" section above for the current picks, or visit /alternatives/werf for the full list with editorial commentary on each.