Syslog is a standard way for computers and network devices to send short text messages about what is happening on them. Think of each message as a quick note: “Someone logged in”, “A link went down”, or “Disk space is low.”
Those notes travel over the network using the syslog protocol — rules that define how the text is formatted and how it is delivered to a syslog server (a program that collects and stores the messages).
Every router, switch, firewall, server, or application can create thousands of events per day. If each device keeps its own logs, troubleshooting becomes slow:
The syslog protocol solves this by letting devices push events to one central place in real time. That is the job of a syslog server — and on Windows, tools like Syslog Watcher receive and manage those messages.
The flow is simple:
You do not need to poll devices one by one. They send logs to you automatically — as long as they are configured with the IP address of your syslog server.
A syslog message is plain text. It always includes a priority (how urgent the event is) and a message body (what happened). Two common formats are BSD syslog (RFC 3164) — older, very common on network gear — and RFC 5424 — newer and more structured.
Often used by Cisco, Juniper, and similar devices:
<134>Oct 11 22:14:15 switch01 %LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed state to upReading this line:
<134> — priority (facility + severity encoded as one number).Oct 11 22:14:15 — timestamp.switch01 — hostname of the device that sent the message.<165>1 2024-06-15T10:30:00.123Z firewall01.example.com filter - ID47 [example@32473] BOOMHere you also get a structured timestamp, hostname, and optional structured data in square brackets.
A good syslog server parses these lines so you can filter by severity, device name, or keywords — not just read raw text.
Syslog defines eight severity levels. Lower numbers mean more urgent:
| Level | Name | Simple meaning | Example |
|---|---|---|---|
| 0 | Emergency | System unusable | Core router failure |
| 1 | Alert | Immediate action needed | RAID array failed |
| 2 | Critical | Serious failure | VPN service down |
| 3 | Error | Error condition | Authentication failed |
| 4 | Warning | Something unusual | High CPU usage |
| 5 | Notice | Normal but important | Configuration saved |
| 6 | Informational | Routine information | User logged in |
| 7 | Debug | Detailed diagnostic | Packet trace details |
Most day-to-day messages are Informational (6) or Warning (4). Security teams often alert on Error and above.
The syslog protocol can ride on different transports:
| Transport | Port | In simple terms |
|---|---|---|
| UDP | 514 | Fast and lightweight; a message might be lost if the network is busy (common default). |
| TCP | 514 (or custom) | Reliable delivery; messages are not lost as easily. |
| TLS | often 6514 | Encrypted syslog — important for compliance and untrusted networks. |
Syslog Watcher accepts syslog over UDP, TCP, and TLS, and supports both RFC 3164 and RFC 5424.
Windows uses its own Event Log format — not syslog — for local OS and application events. Network devices rarely send Windows Event Log; they send syslog.
| Syslog protocol | Windows Event Log | |
|---|---|---|
| Typical sources | Routers, firewalls, Linux, appliances | Windows OS and Windows apps |
| Format | Text lines (RFC 3164 / 5424) | Windows-specific records |
| On Windows Server | Needs a syslog receiver (e.g. Syslog Watcher) | Built into Windows |
You can use both: EventLog Inspector forwards Windows events to your syslog server so everything appears in one place. See also Syslog for Windows.
sshd, nginx, systemd, and application logs.If a product has a “Syslog server” or “Remote logging” setting, it almost certainly speaks the syslog protocol.
Now that you know what the syslog protocol is:
For full product documentation, see the Syslog Watcher User Guide.