Syslog is a standard protocol and message format for forwarding log and alarm messages – each tagged with a facility and severity level – from network devices, servers, and applications to a centralized collector. Defined in RFC 5424, it lets administrators aggregate logs from many sources into one place for monitoring, troubleshooting, and compliance.
Key takeaways
- Syslog tags every message with a facility and a severity level.
- RFC 5424 defines the modern, structured syslog message format.
- UDP port 514 is traditional; TCP and TLS add reliability and encryption.
- VOS devices and Versa Analytics export logs and alarms in syslog format.
- Any syslog-compatible collector or SIEM can receive Versa log exports.
On this page: Why it mattersHow it worksTypesSyslog & VersaFAQ
Why is syslog important?
Syslog is the closest thing networking has to a universal logging language. Routers, switches, firewalls, servers, and applications from different vendors can all emit syslog messages a single collector understands, without a custom parser per source. That interoperability is what makes centralized log management possible at scale.
It matters operationally because most troubleshooting starts with logs: an interface flapping, a certificate expiring, a configuration rolling back all surface first as syslog events, often before a user reports a problem. It matters for security and compliance too – SIEM platforms correlate syslog feeds to detect intrusions, and regulatory frameworks often require centralized, tamper-evident retention that syslog forwarding makes practical.
What is syslog?
A syslog message carries a facility – a code identifying the general source, such as kernel, mail, or a locally defined application – and a severity level, an integer from 0 (Emergency) to 7 (Debug). Together, facility and severity let a receiver filter and route messages: critical alerts to one destination, routine events to another.
The message itself has a header (timestamp, hostname, application tag) and a free-form or structured body. RFC 5424, the current IETF standard, formalized structured data fields and a stricter timestamp format. A syslog sender transmits messages, typically over UDP, to a receiver – a syslog server or collector – that stores, displays, or forwards them onward, often into a SIEM.
Types of syslog
Syslog messages travel over a few transports, and the choice matters. UDP on port 514 is the traditional default: lightweight and connectionless, but messages can be silently dropped under congestion. TCP trades that simplicity for reliability – the sender knows whether the receiver got the message. TLS-secured syslog (RFC 5425) layers encryption and authentication on top of TCP, protecting log content that often includes sensitive operational detail.
Message formats come in two generations. The legacy BSD syslog format (RFC 3164) is a loosely specified, human-readable line many devices still emit for compatibility. The IETF structured format (RFC 5424) adds a versioned header and structured data elements, making messages easier to parse programmatically.
Syslog & Versa
VOS devices generate log and alarm data in syslog format, each tagged with a syslog identifier that labels the log type – for example, alarmLog for alarms or accessLog for firewall access logs – as catalogued in Analytics Log Collector Log Types Overview. A log export functionality (LEF) profile determines where those logs go: a Versa Analytics cluster, a third-party syslog server, or a NetFlow collector, with up to two active destinations at a time. Logs bound for Analytics carry additional IPFIX overhead; logs sent onward to external receivers use standard syslog framing over UDP or TCP port 514.
Alarms follow the same path. As described in Configure VOS Device Alarms, each VOS alarm type has a configurable default destination set – commonly Analytics, SNMP, and syslog together – and Versa Director listens for alarm streams over a syslog-formatted channel from the Analytics log collector export process. Because syslog underlies alarms, flow logs, and event logs alike, it is what lets a third-party SIEM ingest Versa’s operational data without a Versa-specific integration.
Frequently asked questions
What is the difference between syslog facility and severity?
Facility identifies the general source of a message – kernel, application, or a locally defined process – while severity indicates how urgent it is, from Emergency (0) down to Debug (7). Receivers commonly filter and route messages using both fields together, so critical alerts and routine noise land in different places.
What port does syslog use?
Syslog traditionally uses UDP port 514, chosen for its low overhead and connectionless simplicity. Many modern implementations also support TCP on port 514 or a custom port for reliable, acknowledged delivery, plus TLS-secured syslog (RFC 5425) for encrypted transport of sensitive log content.
What is the difference between BSD syslog and RFC 5424 syslog?
BSD syslog (RFC 3164) is an older, loosely specified, human-readable format many devices still emit for backward compatibility with legacy collectors. RFC 5424 is the current IETF standard, adding a versioned header, structured data fields, and precise timestamps that are far easier to parse programmatically.
How does Versa use syslog?
VOS devices tag logs and alarms with syslog identifiers and export them, through LEF profiles, to a Versa Analytics cluster, a third-party syslog server, or a NetFlow collector. Versa Director also receives alarm streams over a syslog-formatted TCP or UDP channel from the Analytics log collector export process.
Is syslog secure by default?
No. Traditional UDP syslog sends messages in plaintext with no delivery guarantee, so messages can be lost or intercepted. Securing it requires TLS-based syslog transport or restricting log traffic to a protected management network, both common practice for sensitive environments.
More on syslog
If you want to learn more, these are sources we trust.
| RFC 5424: The Syslog Protocol | RFC 3164: The BSD Syslog Protocol |
|---|---|
| The current IETF standard: structured message format, facility and severity codes, and transport requirements. | The original BSD-derived format that many devices still emit for backward compatibility with older collectors. |
Related terms
If you’re reading about syslog, these are worth looking at next.
| IP Flow Information Export | Versa Analytics | Analytics Node |
|---|---|---|
| The IETF flow-export standard VOS devices use alongside syslog to send log data to Versa Analytics and NetFlow collectors. | The Versa headend that receives exported logs and alarms, including those sent in syslog format, and turns them into dashboards. | The Analytics cluster personality that stores the aggregated data syslog exports and other logs populate. |