diff --git a/admin/syslog-ng/Makefile b/admin/syslog-ng/Makefile
index e294ff5771..219ce03a82 100644
--- a/admin/syslog-ng/Makefile
+++ b/admin/syslog-ng/Makefile
@@ -1,14 +1,14 @@
 include  $(TOPDIR)/rules.mk
 
 PKG_NAME:=syslog-ng
-PKG_VERSION:=3.9.1
-PKG_RELEASE:=3
+PKG_VERSION:=3.16.1
+PKG_RELEASE:=1
 
 PKG_MAINTAINER:=W. Michael Petullo <mike@flyn.org>
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://github.com/balabit/syslog-ng/releases/download/$(PKG_NAME)-$(PKG_VERSION)/
-PKG_HASH:=5678856a550ae790618fabde9d1447f932ce7a9080d55dca8fc5df1202c70a17
+PKG_HASH:=c7ee6f1d5e98d86f191964e580111bfa71081ecbb3275cea035bbba177b73a29
 
 PKG_INSTALL:=1
 
@@ -18,7 +18,7 @@ include $(INCLUDE_DIR)/nls.mk
 define Package/syslog-ng
   SECTION:=admin
   CATEGORY:=Administration
-  DEPENDS:=+libpcre +glib2 +libeventlog +libopenssl +libuuid +libcurl
+  DEPENDS:=+libpcre +glib2 +libopenssl +libuuid +libcurl
   TITLE:=A powerful syslog daemon
   URL:=http://www.balabit.com/network-security/syslog-ng/opensource-logging-system/
 endef
diff --git a/admin/syslog-ng/patches/001-fix-secret-storage.patch b/admin/syslog-ng/patches/001-fix-secret-storage.patch
new file mode 100644
index 0000000000..b50c63ff39
--- /dev/null
+++ b/admin/syslog-ng/patches/001-fix-secret-storage.patch
@@ -0,0 +1,48 @@
+diff -u --recursive syslog-ng-3.16.1-vanilla/configure.ac syslog-ng-3.16.1/configure.ac
+--- syslog-ng-3.16.1-vanilla/configure.ac	2018-06-01 06:02:07.000000000 -0400
++++ syslog-ng-3.16.1/configure.ac	2018-07-15 19:31:30.307354198 -0400
+@@ -793,6 +793,14 @@
+ AC_CHECK_FUNCS([inotify_init])
+ 
+ dnl ***************************************************************************
++dnl secret-storage headers/libraries
++dnl ***************************************************************************
++
++SECRET_STORAGE_LIBS="\$(top_builddir)/lib/secret-storage/libsecret-storage.la"
++SECRET_STORAGE_NO_LIBTOOL_LIBS="\$(top_builddir)/lib/eventlog/src/.libs/libsecret-storage.so"
++SECRET_STORAGE_CFLAGS="-I\$(top_srcdir)/lib/secret-storage"
++
++dnl ***************************************************************************
+ dnl libevtlog headers/libraries (remove after relicensing libevtlog)
+ dnl ***************************************************************************
+ 
+@@ -1592,7 +1600,7 @@
+ 	java_module_path="$moduledir"/java-modules
+ fi
+ 
+-CPPFLAGS="$CPPFLAGS $GLIB_CFLAGS $EVTLOG_CFLAGS $PCRE_CFLAGS $OPENSSL_CFLAGS $LIBNET_CFLAGS $LIBDBI_CFLAGS $IVYKIS_CFLAGS -D_GNU_SOURCE -D_DEFAULT_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64"
++CPPFLAGS="$CPPFLAGS $GLIB_CFLAGS $EVTLOG_CFLAGS $SECRET_STORAGE_CFLAGS $PCRE_CFLAGS $OPENSSL_CFLAGS $LIBNET_CFLAGS $LIBDBI_CFLAGS $IVYKIS_CFLAGS -D_GNU_SOURCE -D_DEFAULT_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64"
+ 
+ ########################################################
+ ## NOTES: on how syslog-ng is linked
+@@ -1640,7 +1648,7 @@
+ MODULE_DEPS_LIBS="\$(top_builddir)/lib/libsyslog-ng.la"
+ 
+ if test "x$linking_mode" = "xdynamic"; then
+-	SYSLOGNG_DEPS_LIBS="$LIBS $BASE_LIBS $GLIB_LIBS $EVTLOG_LIBS $RESOLV_LIBS $LIBCAP_LIBS $PCRE_LIBS $REGEX_LIBS $DL_LIBS"
++	SYSLOGNG_DEPS_LIBS="$LIBS $BASE_LIBS $GLIB_LIBS $EVTLOG_LIBS $SECRET_STORAGE_LIBS $RESOLV_LIBS $LIBCAP_LIBS $PCRE_LIBS $REGEX_LIBS $DL_LIBS"
+ 
+ 	if test "x$with_ivykis" = "xinternal"; then
+ 		# when using the internal ivykis, we're linking it statically into libsyslog-ng.so
+@@ -1659,8 +1667,8 @@
+ 	# syslog-ng binary is linked with the default link command (e.g. libtool)
+ 	SYSLOGNG_LINK='$(LINK)'
+ else
+-	SYSLOGNG_DEPS_LIBS="$LIBS $BASE_LIBS $RESOLV_LIBS $EVTLOG_NO_LIBTOOL_LIBS $LD_START_STATIC -Wl,${WHOLE_ARCHIVE_OPT} $GLIB_LIBS $PCRE_LIBS $REGEX_LIBS  -Wl,${NO_WHOLE_ARCHIVE_OPT} $IVYKIS_NO_LIBTOOL_LIBS $LD_END_STATIC $LIBCAP_LIBS $DL_LIBS"
+-	TOOL_DEPS_LIBS="$LIBS $BASE_LIBS $GLIB_LIBS $EVTLOG_LIBS $RESOLV_LIBS $LIBCAP_LIBS $PCRE_LIBS $REGEX_LIBS $IVYKIS_LIBS $DL_LIBS"
++	SYSLOGNG_DEPS_LIBS="$LIBS $BASE_LIBS $RESOLV_LIBS $EVTLOG_NO_LIBTOOL_LIBS $SECRET_STORAGE_NO_LIBTOOL_LIBS $LD_START_STATIC -Wl,${WHOLE_ARCHIVE_OPT} $GLIB_LIBS $PCRE_LIBS $REGEX_LIBS  -Wl,${NO_WHOLE_ARCHIVE_OPT} $IVYKIS_NO_LIBTOOL_LIBS $LD_END_STATIC $LIBCAP_LIBS $DL_LIBS"
++	TOOL_DEPS_LIBS="$LIBS $BASE_LIBS $GLIB_LIBS $EVTLOG_LIBS $SECRET_STORAGE_LIBS $RESOLV_LIBS $LIBCAP_LIBS $PCRE_LIBS $REGEX_LIBS $IVYKIS_LIBS $DL_LIBS"
+ 	CORE_DEPS_LIBS=""
+ 
+ 	# bypass libtool in case we want to do mixed linking because it
+Only in syslog-ng-3.16.1-vanilla/: syslog-ng-3.16.1
diff --git a/admin/syslog-ng/patches/100-use-1.0.2k-threadids.patch b/admin/syslog-ng/patches/100-use-1.0.2k-threadids.patch
deleted file mode 100644
index 17c005aa88..0000000000
--- a/admin/syslog-ng/patches/100-use-1.0.2k-threadids.patch
+++ /dev/null
@@ -1,35 +0,0 @@
---- a/lib/crypto.c	2016-12-21 07:57:44.000000000 -0700
-+++ b/lib/crypto.c	2017-03-24 13:19:34.188259018 -0600
-@@ -51,11 +51,20 @@
-     }
- }
- 
-+#if OPENSSL_VERSION_NUMBER < 0x10000000
- static unsigned long
- ssl_thread_id(void)
- {
-   return (unsigned long) get_thread_id();
- }
-+
-+#else
-+static void
-+ssl_thread_id2(CRYPTO_THREADID *id)
-+{
-+  CRYPTO_THREADID_set_numeric(id, get_thread_id());
-+}
-+#endif
- 
- static void
- crypto_init_threading(void)
-@@ -68,7 +76,11 @@
-     {
-       g_static_mutex_init(&ssl_locks[i]);
-     }
-+#if OPENSSL_VERSION_NUMBER < 0x10000000
-   CRYPTO_set_id_callback(ssl_thread_id);
-+#else
-+  CRYPTO_THREADID_set_callback(ssl_thread_id2);
-+#endif
-   CRYPTO_set_locking_callback(ssl_locking_callback);
- }
-