Syslog is the protocol that lets network devices, servers and applications forward their event records (logs) to a central server in a standard format. Born in the 1980s inside Eric Allman's Sendmail project, this simple mechanism is today the common language spoken by nearly every network component — from firewalls to IoT controllers.
Why logs must not stay on the device
Every device can keep its own log for a while, but that is insufficient for three reasons:
- Persistence: Most network devices log to RAM; a reboot wipes everything. Disk-based devices overwrite old records in circular buffers.
- Integrity: An attacker (or a careless admin) with access to the device can erase their traces. A log has no evidential value unless it is stored outside the system where the event occurred.
- Visibility: You cannot chase an incident across 50 devices through 50 separate UIs. Correlation only works when records live in one place.
Syslog solves exactly these problems: the record is copied over the network to a central receiver the moment it is created.
Anatomy of a syslog message
A classic syslog message has three parts: PRI (priority), HEADER (time and source) and MSG (the payload).
<134>Oct 25 10:42:03 fw-hq-01 kernel: DROP IN=eth0
SRC=185.220.101.4 DST=10.0.4.18 PROTO=TCP DPT=22The leading <134> is the PRI field, encoding two values in one number: PRI = Facility × 8 + Severity. Here 134 = 16×8 + 6, i.e. facility local0 (16) and severity Informational (6).
Severity levels
Severity ranges from 0 to 7; 0 is the most critical, 7 the most verbose:
| Code | Name | Meaning |
|---|---|---|
| 0 | Emergency | System is unusable |
| 1 | Alert | Immediate action required |
| 2 | Critical | Critical condition (hardware failure etc.) |
| 3 | Error | Error condition |
| 4 | Warning | Warning — may become an error |
| 5 | Notice | Normal but significant event |
| 6 | Informational | Informational message |
| 7 | Debug | Debugging detail |
A well-designed alerting setup wires severities 0–3 to real-time notifications and keeps 4–7 for dashboards and search.
Facility classes
The facility classifies the producing subsystem: kern (0), user (1), mail (2), auth (4), and local0–local7 (16–23). Most network devices send with an admin-chosen localN, which makes routing by source type easy on the central side.
RFC 3164 vs RFC 5424
For years "syslog" was effectively unstandardized; RFC 3164 (2001) merely documented existing practice (hence "BSD syslog"). RFC 5424 (2009) turned it into a real standard:
| Aspect | RFC 3164 (BSD) | RFC 5424 (IETF) |
|---|---|---|
| Timestamp | No year, no timezone ("Oct 25 10:42:03") | ISO 8601 + timezone + milliseconds |
| Structured data | None — free text | SD-ELEMENT fields (key=value) |
| Encoding | Undefined | UTF-8 |
| App/process identity | Mixed into TAG | APP-NAME, PROCID, MSGID separated |
In the real world both formats coexist: older switches and embedded systems speak 3164, modern firewalls and Linux distributions speak 5424. Your central receiver must therefore parse both — the SYSLOG platform indexes both formats field by field.
Transport: UDP, TCP and TLS
- UDP/514 (RFC 5426): The most common and lightest option — but with no delivery guarantee. Under congestion, packets (i.e. logs) are silently dropped. Acceptable on local, low-volume networks.
- TCP (RFC 6587): Connection-oriented delivery with retransmission. Needs buffer management at high volume.
- TLS (RFC 5425): Adds encryption and authentication on top of TCP. If logs cross the internet between sites or contain personal data, this is the only correct choice.
Rule of thumb: TCP inside the LAN, always TLS over the WAN. Keep UDP only for legacy devices that support nothing else — and watch them with silent-source alerts.
Syslog's place in modern architecture
Syslog is the collection layer; it is not log management by itself. An enterprise pipeline flows like this:
- Collection: Devices via syslog (UDP/TCP/TLS), Windows servers via an agent, applications via file tailing.
- Parsing and normalization: Raw lines are split into fields (source IP, user, action…); each vendor's format maps onto a common schema.
- Signing and retention: Daily files are digested, sealed with RFC 3161 timestamps and archived per retention policy.
- Analysis and alerting: Indexed search, correlation and a rule engine turn critical events into notifications.
In Türkiye this architecture also has a legal dimension: for businesses providing internet access, centralized and stamped logging is mandated by Law No. 5651.
Summary
- Syslog is the lingua franca of log transport; RFC 3164 (legacy) and RFC 5424 (modern) coexist.
- The PRI value encodes facility and severity; alert design is built on severity.
- Prefer TCP on the LAN and TLS on the WAN; treat UDP as a monitored exception.
- Syslog collects; management requires parsing, signing, retention and alerting layers on top.
To build your central log infrastructure — or make your existing one compliant — talk to our team; assessment and sizing are free.