Syslog collects log messages from network devices into a central location. Instead of logging into each device, you search one server.
Syslog message parts:
- Facility identifies the source type (kernel, mail, auth)
- Severity indicates urgency (=emergency to =debug)
- Timestamp shows when the event occurred
- Hostname identifies the source device
Transport:
Traditional syslog uses UDP port . Messages can be lost. Modern implementations use TCP for reliability or TLS for encryption.
Centralized logs are required for correlation. An attack touching multiple devices only makes sense when you see all logs together.