Syslog server for Windows

Syslog Watcher

The actively developed Windows syslog server. Collect, store, analyze, alert, and forward system messages from every device on your network — in one place.

23,000+ licenses sold in 89 countries. Set up in five minutes. Keep the log history that PCI DSS, HIPAA, and SOX audits ask for.

  • High-performance multithreaded architecture
  • Virtual and cloud environment compatible
  • Collect, forward, analyze, and export syslog messages
  • Flexible syslog parser and comprehensive filter rules
  • Alert expressions and syslog reports
  • SIEM integration and filtered forwarding
Download syslog serverWhite paper (PDF)
Download Syslog Watcher. The Manager Server view collecting syslog on UDP 514, beside a parsed FortiGate message.

What is Syslog Watcher?

Windows does not ship with a built-in syslog server. Syslog Watcher fills that gap — the syslog for Windows solution network teams use when they need native collection on Windows Server and desktop editions. How to install a syslog server on Windows Server, or browse resources.

Capabilities

End-to-end syslog management

Four parts of Syslog Watcher work together to turn raw network chatter into something you can search, keep, and forward.

  • CollectUDP, reliable TCP, and encrypted TLS — accept syslog from any network device.
  • StoreSQLite-backed engine wrote 35k+ msg/s in our tests, with built-in retention.
  • AnalyzeFilters, a virtualized viewer, and instant search across millions of messages.
  • ForwardForward to SIEM over UDP/TCP/TLS, or export to ODBC, CSV, XML, and JSON.

Explore the full feature set

Compatibility

Works with everything you already run

If it speaks syslog, Syslog Watcher receives it.

  • Network gear

    Cisco · Fortinet · Palo Alto · SonicWall · Meraki · Ubiquiti · MikroTik · Sophos · Juniper · Aruba · Extreme

  • Servers & endpoints

    Linux syslog/journald · Windows Event Log (via EventLog Inspector) · ESXi · VMware vCenter · Proxmox · TrueNAS · Synology · QNAP

  • Forwards to

    Splunk · Graylog · QRadar · Microsoft Sentinel, Datadog, Sumo Logic, Elastic (via their syslog collector) · Generic UDP / TCP / TLS

  • Runs on

    Windows 8.1, 10, 11 · Windows Server 2012 R2, 2016, 2019, 2022, 2025 · Bare-metal, VM, or cloud Windows instance

  • 19

    Years of experience

    since Syslog Watcher 1.0 (May 2007)

  • 23k+

    Licenses sold

    to customers who prefer Syslog Watcher

  • 24

    Resellers

    distribute Syslog Watcher worldwide

  • 89

    Countries

    with Syslog Watcher customers

Testimonials

What customers say

From administrators who collect syslog on Windows.

  • “The new Syslog Watcher 7 release looks really good so far! We’ve started looking at the new version and are very positive about the improvements. Thanks, and keep up the good work with version 7!”

    Business customer, Sweden

  • “I have gone ahead and fresh installed v7. A big leap indeed, and from what I can initially tell, the leap produced a well organized intelligent system of log message collection, management, and reporting.”

    Rob C., Verified User

  • “We have found Syslog Watcher 6.5.17 and 7.0.5 to be brilliant pieces of syslog software. To me, they are probably the best made. Please keep up the solid work”

    IP PBX Support

Using Syslog Watcher? Share your experience or feedback.

Why teams pick it

Built for the work you actually do

  1. Network devices sending syslog to a Windows collector protected by a security shield

    01

    Syslog Server for Security

    Network devices log failed logins, blocked connections, and configuration changes. Collected in one place, those messages show suspicious activity while it is happening, so an administrator can respond before it spreads.

    Syslog Watcher alerts on the messages you mark as suspicious, so a brute-force attempt or an unexpected admin login reaches someone’s inbox instead of waiting in a device’s log buffer.

    Alerts fire on a matching message as it arrives — not at the next manual log review.

  2. Encrypted syslog archive with TLS lock and an audit checklist

    02

    Syslog Server for Compliance

    PCI DSS (Requirement 10) and HIPAA (§164.312(b)) require audit logs of activity on the systems they cover. SOX controls, GDPR, and CCPA ask for appropriate security, and retained logs are a common way to show it. A syslog server keeps that record in one place, away from the devices that produced it, and you can copy the archive to cloud storage for longer retention.

    Syslog Watcher collects over TLS (RFC 5425) and keeps a compressed archive of the collected messages, synced daily and optionally encrypted with a password. You set how many days the storage and the archive keep messages.

    • PCI DSS
    • HIPAA
    • SOX
    • GDPR
    • CCPA
  3. Searching a syslog message list on a timeline to find the fault

    03

    Troubleshooting with Syslog Server

    Syslog servers are commonly utilized to troubleshoot network issues. When a network device or server is not operating correctly, the syslog server can provide valuable information about what went wrong and when.

    Syslog Watcher filters and searches messages from every device at once, so you can go from “the VPN dropped at 3 a.m.” to the message that explains it without logging in to each device.

  4. Network devices correlated on a dashboard for visibility and capacity planning

    04

    Network Visibility & Proactive Management

    With a syslog server, organizations gain greater visibility and control across their infrastructure to address critical challenges such as optimizing system performance. Without a centralized message server, important log data can be scattered across different devices, making it difficult to correlate.

    By analyzing log data, you can gain insights into network usage patterns, identify potential bottlenecks, and plan for future capacity upgrades.

  5. Syslog Watcher filtering logs from network devices and forwarding them to a SIEM

    05

    Integration with SIEM Solutions

    Syslog Watcher integrates with other troubleshooting and monitoring tools, such as SIEM systems, network monitoring solutions, and database servers.

    SIEM systems use advanced analytics, machine learning, and correlation rules to detect potential security threats and anomalies. By feeding them via Syslog Watcher, the SIEM gets richer log data and improves its ability to identify suspicious patterns.

    How to slash your Splunk bill with Syslog Watcher

Customers

Used by teams at organizations including

  • Tourism Ireland
  • NTT DATA
  • Pacific Blue Cross
  • Panasonic
  • Schneider Electric
  • Siemens

All logos, trademarks, and registered trademarks are the property of their respective owners.

FAQ

Common questions

Free License, evaluation, Windows syslog server, and how Syslog Watcher fits a SIEM or compliance archive.

Does Windows include a syslog server?

No. Microsoft Windows does not include a built-in syslog server. A Windows syslog server is dedicated software that runs on Windows to collect, store, and analyze syslog messages from network devices and applications. Syslog Watcher is a Windows syslog server — download the installer, install it on a Windows host, and point your devices at it. See Windows syslog server for a longer overview.

Is there a free license?

Yes. The installer includes a Free License by default — no license key, no credit card, and no expiry. You may use it at home or inside your organization, but not to provide services to third parties. It is limited to 3 syslog originators and 5,000 messages per hour. Download the installer to start with that license immediately. You can request any license type for a 30-day evaluation for free. Commercial licenses are listed on the licensing page.

What do I get during the 30-day evaluation?

You can request any license type for a 30-day evaluation for free. Download the installer, install it on any supported Windows host, and start collecting syslog from your devices immediately. The evaluation is the full feature set. After it ends, you can keep running on the Free License (3 originators, 5,000 messages per hour) or buy a commercial license. Technical support is included during the evaluation — we will be happy to help configure Syslog Watcher to match your requirements and get it running. Email support@ezfive.com if you need a hand. If you decide to buy, every paid license also comes with a 30-day money-back guarantee, so the total risk-free evaluation window is up to 60 days.

Is it a one-time purchase or a subscription?

One-time purchase. You pay once and keep using the license. The maintenance window (1, 3 or 5 years) gives you free version upgrades and technical support; after it expires, the product keeps running on the last version you installed. You can renew or extend maintenance at any time by emailing sales@ezfive.com.

How do I count syslog originators for license sizing?

A syslog originator is any device or service that sends messages to Syslog Watcher — a firewall, switch, router, server, ESXi host, access point or appliance. One device equals one originator regardless of how many messages it produces. Count your active originators, add headroom for growth, and pick the closest tier. You can upgrade later without losing collected data.

What Windows versions are supported?

Windows Server: 2012 R2, 2016, 2019, 2022, 2025.
Windows client: 8.1, 10, 11.

Runs equally well on bare metal, a Hyper-V / VMware / Proxmox virtual machine, or a cloud Windows instance on AWS, Azure or GCP.

Which syslog standards and protocols are supported?

All of the standards your devices speak:

  • Syslog over UDP — RFC 5426
  • Reliable syslog over TCP — RFC 6587
  • Secure syslog over TLS — RFC 5425
  • BSD format (RFC 3164) and modern IETF format (RFC 5424)
  • CEF (Common Event Format) for SIEM interoperability
  • UTF-8 and non-ASCII encodings, IPv4 and IPv6, unlimited listening addresses

Vendor-specific message formats are handled by customizable regex parsers and Knowledge Base files.

Can I forward to my SIEM — Splunk, Sentinel, Elastic, Graylog, QRadar, Datadog?

Yes — to any combination, simultaneously. Forward via UDP, TCP or TLS to as many destinations as you need. Apply filters so each SIEM only receives the subset of messages it actually needs — the easiest way to cut a per-GB SIEM ingest bill. You can also export to SQL/NoSQL databases via ODBC, or to CSV, XML and JSON files for analytics pipelines.

Does it help with PCI DSS, HIPAA, SOX or GDPR compliance?

It covers the log collection and retention part. Syslog Watcher collects device logs in one place, encrypts them in transit over TLS (RFC 5425), and keeps a compressed archive, synced daily and optionally encrypted with a password. You set how many days the storage and the archive keep messages. Compliance also depends on how you run the server, so here is what it helps with:

  • PCI DSS v4.0, Requirement 10: logs from your devices on a central internal log server (10.3.3), and retention you set in days — for example, 3 months in searchable storage and 12 months in the archive (10.5.1).
  • HIPAA Security Rule: a record of activity on systems that handle ePHI (audit controls, §164.312(b)), with TLS for logs in transit (§164.312(e)(1)).
  • SOX, GDPR, CCPA: no rule names syslog, but retained, encrypted logs are common evidence for IT general controls (SOX) and for appropriate security of processing (GDPR Article 32, CCPA).

What stays with you: limiting who can reach the server and the archive, reviewing the logs (alerts help), keeping device clocks synchronized, and protecting logs from changes.

How fast is the storage and how much data can it hold?

Storage is built on the SQLite engine, tuned for syslog workloads. In our tests it handled 35,000+ writes/sec and 250,000+ sequential reads/sec. Maximum storage size is limited only by your disk. You can cap storage by size or by retention period (days), and messages are pre-indexed by originator and severity so search stays fast even with millions of records.

How long does installation take?

About five minutes. Download the installer, run it on your Windows host, and point your devices at the Syslog Watcher server on UDP 514 (or TLS 6514). Most teams have a working setup — including the archive — within an hour. The step-by-step install guide walks through a typical deployment.

Where is my data stored, and how do I get support?

Your data stays on your Windows server. Syslog Watcher is on-premises software — collected logs never leave your network unless you explicitly configure forwarding or a cloud archive destination. The local SQLite storage lives on the disk you choose; the optional encrypted archive can be on a local disk, a network share, or cloud storage.

Support: email support@ezfive.com, open a ticket at support.ezfive.com, or consult the full User Guide. Technical support is included with active maintenance.

Try Syslog Watcher today

The installer includes a Free License by default (3 syslog originators). You can request any license type for a 30-day evaluation for free, so you can verify everything on your own infrastructure.

Download free trialCompare licenses