Amazon CloudWatch now ingests syslog — no more log shippers

CloudWatch can now take syslog directly. The old way was to run a log shipper on each host, point it at the syslog socket, and keep that service alive. Now the service does it natively. Syslog messages go straight into CloudWatch without the extra hop.

It's a small change with real weight. Syslog is the quiet workhorse of Linux logging — the one that's been in the kernel since the 1980s, used by everything from the base OS to systemd to Docker. When it's baked in, you're not adding another moving part.

This is the kind of thing that keeps the ops team up at 3 a.m. — fewer services to babysit, fewer configs to drift. The log shipper was the cousin who always showed up to the party and then never left. Now it can take a break.

Why this matters for us: when the infrastructure gets simpler, the people who actually run it — the ones who don't have a Slack channel for every tool — get one less thing to break.