Coming next
FuciniLog
Logging for Windows hosts and embedded targets, encrypted end to end.
A small log collector for Windows with client libraries for .NET (C#), C and C++ today — Python, Ruby, Go, Rust, Kotlin/Java and Swift to follow — and a MISRA-style C99 core for embedded and Linux targets. Speaks gRPC, syslog and GELF, or writes straight to a file or the Windows event log; with envelope encryption switched on, only the holder of the private key can read the archive. Comes with a live web viewer and a command-line tail.
It adopts standards rather than inventing formats, so it drops into an NXLog, rsyslog, Graylog or OpenTelemetry landscape without adapters. The table below says which, and which are still to come.
Open core: every client library and the collector are open source under the MIT licence; a licensed Pro edition adds key management, tamper-evident archives, enterprise integrations, the safety qualification kit and support. The line is drawn the same way as for Coverage Studio: everything you need to log, ship, read and verify is free and open, so nobody has to trust a closed component with their log data or their crypto; what is sold is scale, proof, integration, qualification and support. Clients are always free — a library that costs money is a library nobody adds to a device.
Standards adopted
| Area | Standard | Where | Status |
|---|---|---|---|
| Syslog | RFC 5424 (structured data element fucinilog@32473), RFC 3164 (BSD), RFC 6587 (TCP octet counting), RFC 5425 (syslog over TLS) | every client, collector inputs and forwarders | available |
| Graylog | GELF 1.1 over UDP (chunked, gzip) and TCP | every client, collector inputs and forwarders | available |
| Serilog | Compact Log Event Format (CLEF) | file tail input, file output, local file target | available |
| Transport | gRPC over HTTP/2, gRPC-Web over HTTP/1.1, Protocol Buffers 3 | collector inputs, every client | available |
| Windows | Windows Event Log (Application log), Windows service (SCM) | local target of every Windows client, collector output | available |
| Tracing | W3C Trace Context ids (trace id / span id, OpenTelemetry compatible) | record model, every format | available |
| Cryptography | NIST P-256 ECDH (FIPS 186-4), HKDF (RFC 5869), AES-256-GCM (NIST SP 800-38D), SHA-256 (FIPS 180-4) | envelope encryption, sealed archives | available |
| Coding | MISRA C:2025, MISRA C++:2023 (Lite core and wrapper), C99, C++17, C++20 | embedded clients | available (checker with rule texts in Pro) |
| OpenTelemetry | OTLP logs (protobuf over gRPC / HTTP) as input and export | collector | planned |
| SIEM | CEF (ArcSight), LEEF (QRadar), Elastic Common Schema (ECS) field mapping | collector forwarders | planned, Pro |
| Linux | systemd journal (journald) input, Linux service unit | collector on Linux | planned |
| Integrity | RFC 5848 signed syslog, hash-chained archives with signed manifests (RFC 3161 time stamps) | collector outputs | planned, Pro |
| Events | CloudEvents 1.0 envelope for webhooks | collector forwarders | planned |
Open source and licensed, feature by feature
| Capability | Community (MIT, GitHub) | Pro (licence key, per host or per site) |
|---|---|---|
| Wire contract (protobuf), encryption scheme, key formats | open, specified, test vectors published | same |
| Client libraries and the Lite core for embedded and Linux | all of them, every transport, encryption included | same |
| Collector: every input, routes, file / sealed file / event log / console / live outputs, forwarding to syslog, GELF, flog, gRPC | yes | yes |
Web viewer and fucinilog-cli | yes | plus saved queries, cross-archive search, alerts |
| Key management | key files, auto-generated pair | Windows CNG / TPM and Azure Key Vault backed private keys, key rotation, hardware-backed sealing |
| Tamper evidence | authenticated envelopes (GCM) | hash-chained archives, signed daily manifests, RFC 3161 time stamps, verification tool and report |
| Retention and compliance | days-based retention | write-once storage (Azure Blob immutability, WORM shares), legal hold, retention policies per application |
| Enterprise integrations | syslog / GELF / flog / gRPC forwarding | OTLP, Splunk HEC, Elastic (ECS), Azure Monitor, CEF / LEEF, CloudEvents webhooks |
| Fleet | one collector per host | central console: fleet status, configuration push, certificate and key roll-out, RBAC with Entra ID |
| Safety | MISRA-style Lite core, cppcheck evidence | qualification kit: MISRA report with the official rule texts, TriCore / ARM reference builds, safety manual, requirements tracing, MC/DC coverage report |
| Support | GitHub issues | SLA, security advisories, LTS branches, signed installers (MSI), private NuGet / package feeds |
Why this split. Encryption only earns trust when it can be read; so the scheme, the keys and every client are open. A device manufacturer can embed the Lite core in firmware without a licence question. What a company pays for is what it would otherwise have to build and defend itself: proof that an archive is untouched, keys that never leave a TPM or a vault, exports into the tools its security team already runs, and a qualification package it can hand to an assessor.
Hear when it ships
One email per release or announcement, nothing else. Unsubscribe any time, no login needed.
Would this decide something for you? Say so — that is how the order gets decided.