Syslog is the standard protocol for sending log messages from network devices, servers, and applications to a centralized log collector. Per IETF RFC 5424, Syslog defines a structured message format with severity levels (0-7), facility codes, timestamps, and message bodies. It runs on UDP port 514 (traditional) or TCP port 6514 (TLS-encrypted per RFC 5425).
Key takeaways
- Syslog is the standard protocol for centralized log forwarding (RFC 5424).
- 8 severity levels (0=Emergency to 7=Debug) and 24 facilities classify messages.
- Traditional: UDP 514 (unreliable, unencrypted). Modern: TCP 6514 (TLS encrypted).
- Universal support: every network device, Linux distro, and most applications.
- Forward to a SIEM (Splunk, Elastic, Sentinel) for correlation and alerting.
Quick explanation
In simple terms
Syslog is a way for network devices and servers to send their log messages to a central server for storage and analysis.
Technical definition
Syslog is an IETF standard (RFC 5424) for log message transport, defining a structured message format with PRI (facility + severity), VERSION, TIMESTAMP, HOSTNAME, APP-NAME, PROCID, MSGID, STRUCTURED-DATA, and MSG fields, transported over UDP 514, TCP 514, or TLS-encrypted TCP 6514 (RFC 5425).
Analogy
Syslog is like a postal service for log messages. Devices write messages (letters) with an urgency level (severity) and category (facility), and send them to a central post office (Syslog server) that sorts, stores, and routes them.
Definition
Syslog is the standard protocol for sending log messages from network devices, servers, and applications to a centralized collector. Per RFC 5424, it defines 8 severity levels (0-7) and 24 facilities, and runs on UDP 514 or TCP 6514 (TLS).
Syslog is a standard protocol for log message transport, defined in IETF RFC 5424 (message format) and RFC 5425 (TLS transport). It provides a structured way for network devices, servers, and applications to send log messages to centralized collectors.
A Syslog message includes a priority value (PRI) encoding the facility (source type, 0-23) and severity (urgency, 0-7), a timestamp, hostname, application name, process ID, message ID, optional structured data, and the message body. Traditional Syslog uses UDP port 514; modern deployments should use TCP port 6514 with TLS encryption per RFC 5425.
Why it matters
Core concepts
Severity levels (0-7)
A numerical code (0-7) indicating the urgency of a Syslog message.
Per RFC 5424, the 8 severity levels are: 0=Emergency, 1=Alert, 2=Critical, 3=Error, 4=Warning, 5=Notice, 6=Informational, 7=Debug. The severity drives alerting logic in SIEM platforms: levels 0-3 typically trigger alerts, 4-5 are monitored, 6-7 are for analysis.
Example
Level 0 (Emergency): system is unusable. Level 4 (Warning): something unexpected. Level 6 (Informational): normal operation. Level 7 (Debug): verbose troubleshooting.
Facilities
A numerical code identifying the type of system or application that generated the message.
Per RFC 5424, facilities allow the Syslog server to route messages to different log files or processing pipelines based on source type. The local0-local7 facilities (16-23) are reserved for custom application use.
Example
Facility 0=kern (kernel), 4=auth (authentication), 10=authpriv (private auth), 16-23=local0-local7 (custom).
How it works
Log message generation
A device or application generates a log message with a facility code, severity level, timestamp, hostname, and message body. The message is formatted per RFC 5424 or the older BSD format (RFC 3164).
Device → Syslog message
Network transport
The device sends the Syslog message over the network to a configured Syslog server. Traditional: UDP 514 (fire-and-forget). Modern: TCP 514 (reliable) or TCP 6514 (TLS encrypted).
UDP/TCP → Syslog server
Server reception and routing
The Syslog server (rsyslog, syslog-ng) receives messages, parses them, and routes them based on facility and severity: write to log files, forward to a SIEM, or store in a database.
Server → Parse + Route
Analysis and alerting in SIEM
SIEM platforms index Syslog data for searching, correlation, dashboarding, and alerting. Security teams create rules to alert on specific patterns (e.g., multiple auth failures from a single IP).
SIEM → Correlate + Alert
Benefits
Centralized log collection
Syslog aggregates logs from routers, switches, firewalls, servers, and applications into a single location for analysis, correlation, and retention.
Standardized severity and facility classification
Per RFC 5424, Syslog defines 8 severity levels (0=Emergency to 7=Debug) and 24 facilities (kern, auth, mail, local0-local7), providing standardized log classification.
Universal support across devices and platforms
Almost every network device, operating system, and application supports Syslog output. It's the lowest common denominator for log forwarding.
Limitations
UDP transport is unreliable
HighTraditional Syslog over UDP doesn't guarantee delivery. Messages can be lost during network congestion without the sender or receiver knowing.
Workaround — Use TCP-based Syslog (port 514 or 6514) for reliable delivery. rsyslog and syslog-ng support TCP with queue buffering.
No encryption by default
HighUDP Syslog (port 514) sends messages in plaintext, including sensitive data like authentication events and system errors.
Workaround — Per RFC 5425, use Syslog over TLS (TCP port 6514) for encrypted transport. Both rsyslog and syslog-ng support TLS.
Examples
Network security monitoring via Syslog
A security team configures all firewalls, routers, and switches to forward Syslog to a SIEM platform for centralized security monitoring.
Network devices send Syslog messages for configuration changes, authentication attempts, interface state changes, and security events. The SIEM correlates these with server and application logs to detect attack patterns.
Comparisons
Syslog vs. SNMP
Syslog vs. Windows Event Log
Myths, corrected
Myth
Syslog is only for Linux systems
Correction
Syslog is supported by virtually every network device (Cisco, Fortinet, Palo Alto), Linux, macOS, and many Windows applications. Windows Event Logs can be forwarded as Syslog using agents like NXLog.
Why it happens: Linux uses Syslog as its native logging system (rsyslog/journald), creating the perception that it's Linux-only.
Myth
Syslog is outdated and replaced by modern logging
Correction
Syslog remains the universal log forwarding protocol. Modern logging platforms (Splunk, Elastic, Graylog) all accept Syslog as a primary input. RFC 5424 (2009) defines structured Syslog with UTF-8 support and structured data elements.
Why it happens: Newer log shipping tools (Fluentd, Filebeat) and structured logging (JSON) are sometimes positioned as replacements, but they complement Syslog rather than replace it.
Practical implications
For admins
Configure all network devices to forward Syslog to a central collector. Use facility local0-local7 for custom application logs. Set appropriate severity levels.
For business
Centralized logging is a compliance requirement for PCI DSS, HIPAA, SOX, and GDPR. Syslog is the most common way to achieve it.
For security
Forward Syslog to a SIEM for real-time correlation and alerting. Monitor auth facility (4) and authpriv facility (10) for authentication events. Use TLS for Syslog carrying sensitive data.
Related terms
rsyslog
The default Syslog implementation on most Linux distributions.
syslog-ng
A commercial/open-source Syslog daemon with advanced filtering and routing.
SIEM
Security Information and Event Management, which ingests and correlates Syslog data.
Frequently asked questions
What port does Syslog use?
Syslog traditionally uses UDP port 514 for unencrypted transport. Modern deployments use TCP port 514 for reliable delivery and TCP port 6514 for Syslog over TLS (encrypted).
What are the Syslog severity levels?
Per RFC 5424: 0=Emergency, 1=Alert, 2=Critical, 3=Error, 4=Warning, 5=Notice, 6=Informational, 7=Debug. Lower numbers indicate higher severity.
What Syslog server should I use?
Popular Syslog servers include rsyslog (default on most Linux), syslog-ng, Graylog, and Fluentd. Enterprise SIEM platforms (Splunk, Elastic, Microsoft Sentinel) also accept Syslog input directly.
Is Syslog encrypted?
Traditional Syslog over UDP is unencrypted. Per RFC 5425, Syslog over TLS (TCP port 6514) encrypts log data in transit. Always use TLS for Syslog carrying sensitive data.
Can Windows send Syslog messages?
Use agents like NXLog, Snare, or the Windows built-in Syslog forwarder to convert Windows Event Logs to Syslog format and forward to a centralized collector.
Conclusion
Syslog is the standard protocol for forwarding log messages from devices and applications to a centralized collector. Per RFC 5424, messages include a facility, severity (0-7), timestamp, hostname, and message body.
Traditional Syslog uses UDP 514 (unreliable, no encryption). Modern deployments should use Syslog over TLS (RFC 5425, TCP 6514) for reliability and confidentiality. Forward Syslog data to a SIEM (Splunk, Elastic, Microsoft Sentinel) for correlation, alerting, and compliance.
Main takeaway
Explore Syslog over TLS (RFC 5425), structured Syslog (RFC 5424 structured data), and SIEM integration for security monitoring and compliance.
