There are three different sets of labs, and three presentation.

- One covering syslog-ng, followed by a lab on syslog-ng and tenshi
- One covering rsyslog, followed by a lab on rsyslog and swatch
- One covering rsyslog, followed by a lab on rsyslog and loki

Technically we could combine these differently (syslog-ng + swatch, as was the case originally, for example).

There’s an argument for sticking to rsyslog, as it’s the default syslog daemon in 14.04+. There were originally issues with rsyslog, in particular it being very picky about spaces vs tabs, which tend to cause issues during labs, but this is no longer a problem.

Unlike tenshi or swatch, loki doesn’t watch for patterns in your logs. You can of course also do the swatch exercise hanging off rsyslog - but it might be worth moving to something more grown-up like ossec/wazuh or sagan.