syslogs

Syslog is a standard for event logging used by Unix-like systems and many network devices. It describes how software can generate log messages and how those messages are transmitted to a central log collector. The protocol originated in the 1980s as part of UNIX logging facilities and has evolved through RFC 3164 and RFC 5424.

A syslog message includes a priority value that encodes facility and severity, a timestamp, the hostname, a tag (usually the program name), and the textual message. Messages are commonly transported over UDP port 514, but TCP and TLS are supported in modern implementations to improve reliability and security. Centralized syslog servers store, rotate, and optionally forward messages to other systems or security information and event management tools.

Facilities categorize the source of a message, with examples such as kern, user, mail, daemon, auth, syslog, lpr, news, cron, and the local0–local7 facilities. Severities describe importance, ranging from emerg and alert down to crit, err, warning, notice, info, and debug.

Popular implementations include rsyslog, syslog-ng, and systemd-journald’s syslog forwarding. In practice, syslog is used for troubleshooting, monitoring, and compliance. Centralized logging across hosts and devices enables correlation, alerting, and long-term retention.

Security considerations include authenticating senders and protecting message integrity, typically via TLS or IPsec, as well as access controls and proper network segmentation. Some environments integrate syslog data into larger logging pipelines for analysis and auditing.