A syslog relay and exploder for modern infrastructure
Echo Base receives syslog messages on UDP ports 514 and 5514, applies your routing rules, and fans them out to one or more destination pools — optionally spoofing the original source IP so your SIEM, log archive, or analysis platform sees the real device address instead of Echo Base’s own IP.
If you’ve used a syslog exploder or relay before — including legacy tools that are no longer actively maintained — Echo Base is a modern, actively supported replacement.
Features
- Round-robin and random load balancing across destination pools
- IP spoofing via raw sockets — downstream systems see the original source IP, not Echo Base’s
- Priority-based routing rules matching on source IP, facility, severity, hostname, app name, and message content
- Duplicate action — fan a single message out to multiple pools simultaneously
- ICMP health checking per destination, with configurable intervals and failure/success thresholds
- Real-time statistics — messages received, sent, dropped, and per-second throughput
- Hash-based login with session cookie auth on all API endpoints
- Dual-port listening on both 514 and 5514 simultaneously
Destination pools
Group destinations into pools, each with independent health checking. Unhealthy destinations are automatically skipped until they recover.
Routing rules
Rules evaluate in priority order. Route sends to a single pool and stops. Duplicate sends to a pool and continues evaluating — this is how you fan a message out to multiple destinations. Drop discards it entirely.
Deployment
Runs as a single Go binary or Docker container. Deploy on bare metal, in a Proxmox LXC (with NET_RAW capability for spoofing), or via Docker with --network=host --cap-add=NET_RAW.
Benchmark it first
Not sure how Echo Base will perform at your message volume? Endor Ops is a free distributed load-testing tool built specifically for testing syslog and SNMP trap relays — use it to benchmark your infrastructure before you buy.