Windows Server has no syslog server role. Firewalls, switches, and Linux hosts send syslog, but Windows Event Log does not receive it. A Windows syslog server — syslog for Windows — is the program you install to collect those messages on a Windows machine. The steps to install Syslog Watcher on a server are in How to install a syslog server on Windows Server.
What Windows already logs
Windows already keeps its own events. Event Log and Windows Event Forwarding, listed below, store those events. Neither of them listens for syslog.
| Component | What it collects | Limit |
|---|---|---|
| Windows Event Log | Events from the local Windows system and its applications | Does not receive syslog from a firewall, switch, or Linux host |
| Windows Event Forwarding | Windows Event Log records, from other Windows computers to a collector | Does not speak syslog. A FortiGate, for example, cannot target a WEF subscription |
| Syslog Server | Syslog over UDP, TCP, or TLS | Does not replace Event Log. Windows events reach it through EventLog Inspector, which forwards them as syslog |
Routers and firewalls send syslog to the syslog server. EventLog Inspector forwards Windows security and system logs to the same server, and one search covers both the network device and the Windows hosts.
The syslog protocol is the message format: a severity and a text payload.
Windows Server, or a Linux VM
Linux distributions usually include rsyslog or syslog-ng, so a Linux collector is a normal choice when Linux is already in the rack. On a Windows-only site, a Linux VM is another system to patch, and another place that holds the logs.
Use a Windows syslog server when:
- The site is Windows, and the collector should run on a Windows Server you already administer.
- A branch has a Windows server and no Linux host.
- You want the raw messages on Windows, and a filtered copy forwarded to Splunk, Elastic, or another SIEM. Filtering before the SIEM cuts the ingest bill.
- An audit requires a retained copy of device logs. The archive can stay on the server or be copied onward, including to cloud storage such as S3.
A collector in front of the SIEM keeps the messages if the SIEM is down or the license is full.
A free syslog server for Windows
A free Windows syslog server usually limits devices or messages. TLS and vendor support are often not included.
The Syslog Watcher installer includes a Free License: 3 originators and 5,000 messages per hour, with no expiry. An originator is one sending device.
Questions
Does Windows Server include a syslog server?
No. Windows Server has no syslog server role, including Windows Server 2025. Windows Event Log and Windows Event Forwarding use the Windows event format. To receive syslog from firewalls, switches, and Linux hosts, install a Windows syslog server such as Syslog Watcher.
Is Windows Event Forwarding a syslog server?
No. Windows Event Forwarding moves Windows Event Log records between Windows computers. It does not listen for syslog from network devices.
What port does a Windows syslog server use?
Syslog Watcher listens on UDP 514 by default, on all IPv4 addresses, and the installer creates the inbound firewall rule for that port. TCP and TLS are optional listeners. When you add TLS, port 6514 is the usual port.
Is there a free syslog server for Windows?
Free syslog servers for Windows exist. The Syslog Watcher installer includes a Free License: 3 originators and 5,000 messages per hour, with no expiry. Request a 30-day evaluation of a larger license from Manager.
Do I need Linux to collect syslog?
No. Linux distributions often include rsyslog or syslog-ng, and a Linux VM is a valid collector. A site that already runs Windows Server can collect there instead, and does not need Linux only to store logs.
What to do next
Download Syslog Watcher to try a Windows syslog server. The installer includes a Free License: 3 originators and 5,000 messages per hour. The Syslog Watcher 7.0 user guide is the reference for listeners, TLS, and filters.