Syslog

What is Syslog?

Syslog is a standard protocol for sending log messages from servers, network equipment, security systems and industrial components to a central log server, with every message following a fixed structure of priority, timestamp, sender and content. The protocol emerged in the early 1980s on BSD Unix, where Eric Allman wrote the syslog daemon as part of the Sendmail project, and has since become the common log format of virtually every router, switch and firewall. The current standard is RFC 5424 from 2009. Syslog is widely used in both IT and OT for monitoring, fault detection, auditing and security analysis.

🧠 How does Syslog work?

Syslog defines three roles: an originator that creates the message, an optional relay that forwards messages, and a collector that receives and stores them.

• Creating the message - a device such as a server, industrial switch or PLC records an event, for example a failed login, a link going down or a changed configuration
• Assigning priority - each message gets a facility (the source, such as kernel, security or local0–local7) and a severity (from 0 to 7)
• Sending - traditionally over UDP port 514, more reliably over TCP, and securely over TLS on TCP port 6514
• Collecting and processing - the central syslog server filters, indexes and stores the messages, or forwards them to a SIEM

Syslog is one-way traffic: the sender receives no acknowledgement. Over UDP, messages can therefore be lost without anyone noticing during congestion or network faults.

🔢 What do facility and severity mean?

Severity indicates how urgent a message is. The lower the number, the more severe:

RFC 5424 defines 24 facilities (0 to 23). Codes 4 and 10 are reserved for security and authorisation messages, and 16 to 23 (local0–local7) are free for local use. Many network and OT vendors send their messages through one of these local facilities by default. The priority value in the message header is facility × 8 + severity, giving a range of 0 to 191.

Keep in mind that severity describes the technical condition, not the security relevance. A successful login at level 6 may be the most important line of the day for an analyst. So do not blindly discard everything with a number higher than 4.

🔍 What does a Syslog message look like?

A message according to RFC 5424 looks like this:

<34>1 2025-07-25T14:23:00.003Z host01 su - ID47 - Login for 'root' failed

The older BSD format from RFC 3164 (2001) is still very common. It uses a timestamp such as Jul 25 14:23:00, without a year or time zone, and a message may be at most 1024 bytes. RFC 3164 only documented existing practice; RFC 5424 turned it into a proper standard in 2009.

🔄 Which Syslog standards exist?

Under RFC 5424, a collector must accept messages of at least 480 bytes and should handle 2048 bytes; for UDP over IPv6, RFC 5426 raises the minimum to 1180 bytes. Over TLS, 2048 bytes is mandatory and 8192 recommended. Longer messages from firewalls or applications are therefore sometimes truncated.

🔐 How do you secure Syslog?

Traditional syslog over UDP is unencrypted and unauthenticated. Anyone on the network can read, forge or replay messages, and an attacker can flood the collector. RFC 5426 itself therefore states that using it on an unsecured network is not recommended. Measures:

• Use TLS - syslog over TLS (RFC 5425) protects confidentiality and integrity and reduces message loss thanks to TCP. It is not completely lossless: buffered messages can still disappear when a connection drops. Do not use obsolete SSL.
• Restrict senders - let the collector accept messages only from known IP addresses, and use a firewall to limit port 514 to the log server.
• Store centrally - an attacker who takes over a device often wipes its local logs. A copy on a separate, protected collector is then preserved as evidence for forensic investigation.
• Synchronise clocks - without NTP, timestamps from different devices drift apart and the sequence of an attack cannot be reconstructed.
• Monitor the collector itself - a collector that fills up or stops leaves detection blind. Raise an alert when expected messages stop arriving and watch the free storage space.

Logging through syslog supports several requirements. IEC 62443-3-3 asks for auditable events in SR 2.8, sufficient audit storage capacity and a response to audit processing failures in SR 2.9 and SR 2.10, reliable timestamps in SR 2.11, protection of audit information in SR 3.9 and audit log accessibility in SR 6.1. ISO 27001 covers logging, monitoring and clock synchronisation in controls 8.15, 8.16 and 8.17. Under NIS2 and the Dutch Cybersecurity Act, in force since 15 August 2026, the ability to detect incidents is part of the duty of care.

🏭 How do you deploy Syslog in an OT environment?

In OT, many devices are old or resource-constrained. Older controllers often do not support syslog at all, or only over UDP. A practical approach:

1. Inventory the sources - which industrial switches, industrial firewalls, routers, RTUs, HMIs, SCADA servers and engineering stations can send syslog, and over which transport?
2. Place a collector per zone - a local relay in the zone receives legacy devices over UDP and forwards everything over TLS. This keeps unencrypted traffic inside the zone, in line with network segmentation.
3. Send logs upwards - from the process environment through the DMZ to the central platform, never the other way round. Where requirements are strict, a data diode can enforce one-way traffic.
4. Complement with network monitoring - devices that do not log themselves become visible through passive monitoring and an IDS that understands OT protocols. Those tools in turn forward their alerts via syslog.
5. Limit the load - set severity filters at the source so that debug messages do not consume bandwidth or controller CPU.
6. Define retention periods - decide per category how long logs are kept. Logs containing usernames or IP addresses are personal data under the GDPR, known in the Netherlands as the AVG.

A Dutch water board, for example, can have the firewalls and switches at each pumping station log to a local collector, which forwards everything encrypted to the OT SOC.

🧰 Which tools receive and analyse Syslog?

Security systems such as IDS, IPS and EDR often use syslog as their output channel towards the SIEM.

❓ Frequently asked questions

Which port does Syslog use?

Syslog traditionally uses UDP port 514. Syslog over TLS uses TCP port 6514, and DTLS syslog uses UDP port 6514. Plain TCP syslog usually runs on port 514 in practice as well, but that transport never became an official standard: RFC 6587 only documents it, with Historic status.

Is Syslog secure?

Syslog over UDP is not secure: messages are unencrypted, unauthenticated and can be lost or forged without detection. Syslog over TLS according to RFC 5425 largely solves this with encryption and certificates. Use TLS wherever the device supports it.

What is the difference between RFC 3164 and RFC 5424?

RFC 3164 describes the legacy BSD syslog format, with a timestamp lacking year and time zone and a maximum of 1024 bytes. RFC 5424 is its 2009 successor with a version number, full RFC 3339 timestamps, structured data and UTF-8. Many devices still send the old format.

What is the difference between Syslog and SNMP?

Syslog pushes text event messages from the device to a collector. SNMP polls the status and counters of a device and also offers traps for notifications. Network management typically uses both side by side: SNMP for performance, syslog for events.

Can a PLC send Syslog messages?

Modern PLCs and other OT components increasingly support syslog, often to deliver the audit records that IEC 62443-4-2 requires of components. Older PLCs usually cannot and only log to an internal diagnostic buffer. For those devices, passive network monitoring provides visibility of program changes and stop commands.

Do I need a SIEM to use Syslog?

Syslog works without a SIEM: a central syslog server already stores and searches the messages. A SIEM adds correlation across sources and automated detection. Smaller organisations often start with a central collector and expand later.

📌 In summary

Syslog is the standard protocol for collecting log messages from IT and OT equipment in one central place, using a fixed structure of priority, timestamp, sender and text. Use the modern RFC 5424 format, send over TLS on port 6514, synchronise clocks and place a collector per zone in OT. That makes syslog a reliable building block for operations, incident response and cybersecurity compliance under IEC 62443, ISO 27001 and NIS2.