# Syslog

> Syslog is the standard protocol that network devices, servers and applications use to send event messages to a central log server.

Syslog originated on Unix systems in the 1980s. Today almost every device supports it, from routers and firewalls to servers and hotspot gateways. The legacy BSD format is documented in RFC 3164, while the current protocol was defined in RFC 5424 in 2009. Each message carries a priority (PRI), timestamp, hostname, application name, optional structured data and free-form text.

The priority value combines two parts. The facility identifies the message source (0–23, e.g. kernel, auth, local0–local7). The severity gives its importance (0 Emergency, 1 Alert, 2 Critical, 3 Error, 4 Warning, 5 Notice, 6 Informational, 7 Debug). It is calculated as PRI = facility × 8 + severity, so a warning (4) from local0 (16) has priority <132>.

Traditional transport over UDP port 514 is common, but lost UDP packets go unnoticed. Where reliability matters, TCP (RFC 6587) should be used, and syslog over TLS (RFC 5425, port 6514) for confidentiality and integrity. Software such as rsyslog and syslog-ng can filter, buffer and route messages to multiple destinations.

Central log management is only as useful as its timestamps are accurate. Every device should be synchronised via NTP with a consistent time zone. Some records must be retained for legal reasons, such as access records under Law No. 5651 or CGNAT mapping logs. For those, file hashes should be sealed with trusted timestamps to prove the records were not altered, and access should be restricted by authorisation. Syslog data is also the primary input for SIEM correlation and alerting.

---
Canonical: https://internetten.com.tr/en/glossary/syslog