Dictionary · Protocols and Ports
Syslog
Management · Intermediate
A standard way for systems to send log messages to a collector. Traditional transport is UDP 514. Reliable and encrypted variants also exist.
Devices can forward their events to one place so an investigator is not logging in to every box. The transport should match how important it is that every message arrives and stays private.
Example: Firewalls send messages to a central collector, which keeps them after the firewall's local buffer rolls over.
Ports
- UDP 514 — Traditional log delivery
Common misconception
- Traditional datagram delivery can lose messages. Important security logs often need a reliable transport.