Simple definition
Syslog is a widely used mechanism for sending and centralizing log messages from systems and network devices.
Technical definition
A Syslog message commonly includes a priority derived from facility and severity, plus timestamp, host, and message information depending on the format in use. Transport can use different methods, including UDP, TCP, or TLS depending on the implementation.
How it works / role
A device generates an event, assigns a severity, and sends it to a collector. The central server receives, timestamps, indexes, or forwards the message to a SIEM or monitoring platform. Accurate time synchronization and source identification are essential for event correlation.
What is it used for?
Centralize logs for troubleshooting, monitoring, auditing, and incident detection.
Practical example
A FortiGate sends security events to a Syslog collector that indexes them and raises alerts for selected severities.
Common issues
- Messages are lost because of unreliable transport or congestion
- Inconsistent timestamps due to missing NTP synchronization
- Facility or severity is interpreted incorrectly
- Collector is overloaded or retention is insufficient
Key takeaway: Syslog is most useful when centralization is combined with accurate timestamps, source identification, and appropriate retention.