Syslog is a standard way for computers and network devices to send short text messages about what is happening on them. Think of each message as a quick note: “Someone logged in”, “A link went down”, or “Disk space is low.”
Those notes travel over the network using the syslog protocol — rules that define how the text is formatted and how it is delivered to a syslog server (a program that collects and stores the messages).
Why the syslog protocol exists
Every router, switch, firewall, server, or application can create thousands of events per day. If each device keeps its own logs, troubleshooting becomes slow:
- You must log in to many systems to find one problem.
- Old logs may be deleted when disks fill up.
- There is no single timeline of what happened on the network.
The syslog protocol solves this by letting devices push events to one central place in real time. That is the job of a syslog server — and on Windows, tools like Syslog Watcher receive and manage those messages.
How syslog works (in plain terms)
The flow is simple:
- Something happens on a device (login, error, configuration change).
- The device builds a syslog message — a line of text with a timestamp, severity, and description.
- The device sends the message over the network (usually to port 514).
- A syslog server receives, stores, and lets you search the messages.
You do not need to poll devices one by one. They send logs to you automatically — as long as they are configured with the IP address of your syslog server.
What does a syslog message look like?
A syslog message is plain text. It always includes a priority (how urgent the event is) and a message body (what happened). Two common formats are BSD syslog (RFC 3164) — older, very common on network gear — and RFC 5424 — newer and more structured.
Example: RFC 3164 (classic format)
Often used by Cisco, Juniper, and similar devices:
<134>Oct 11 22:14:15 switch01 %LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed state to upReading this line:
<134>— priority (facility + severity encoded as one number).Oct 11 22:14:15— timestamp.switch01— hostname of the device that sent the message.- The rest — the actual event text.
Example: RFC 5424 (modern format)
<165>1 2024-06-15T10:30:00.123Z firewall01.example.com filter - ID47 [example@32473] BOOMHere you also get a structured timestamp, hostname, and optional structured data in square brackets.
A good syslog server parses these lines so you can filter by severity, device name, or keywords — not just read raw text.
Severity levels (how urgent is the message?)
Syslog defines eight severity levels. Lower numbers mean more urgent:
| Level | Name | Simple meaning | Example |
|---|---|---|---|
| 0 | Emergency | System unusable | Core router failure |
| 1 | Alert | Immediate action needed | RAID array failed |
| 2 | Critical | Serious failure | VPN service down |
| 3 | Error | Error condition | Authentication failed |
| 4 | Warning | Something unusual | High CPU usage |
| 5 | Notice | Normal but important | Configuration saved |
| 6 | Informational | Routine information | User logged in |
| 7 | Debug | Detailed diagnostic | Packet trace details |
Most day-to-day messages are Informational (6) or Warning (4). Security teams often alert on Error and above.
How messages travel over the network
The syslog protocol can ride on different transports:
| Transport | Port | In simple terms |
|---|---|---|
| UDP | 514 | Fast and lightweight; a message might be lost if the network is busy (common default). |
| TCP | 514 (or custom) | Reliable delivery; messages are not lost as easily. |
| TLS | often 6514 | Encrypted syslog — important for compliance and untrusted networks. |
Syslog Watcher accepts syslog over UDP, TCP, and TLS, and supports both RFC 3164 and RFC 5424.
Syslog protocol vs. Windows Event Log
Windows uses its own Event Log format — not syslog — for local OS and application events. Network devices rarely send Windows Event Log; they send syslog.
| Syslog protocol | Windows Event Log | |
|---|---|---|
| Typical sources | Routers, firewalls, Linux, appliances | Windows OS and Windows apps |
| Format | Text lines (RFC 3164 / 5424) | Windows-specific records |
| On Windows Server | Needs a syslog receiver (e.g. Syslog Watcher) | Built into Windows |
You can use both: EventLog Inspector forwards Windows events to your syslog server so everything appears in one place. See also Windows syslog server.
Common devices that use syslog
- Firewalls — blocked connections, policy changes, VPN events.
- Switches and routers — link up/down, routing changes, ACL hits.
- Wireless controllers — client connect/disconnect, rogue AP detection.
- Linux servers —
sshd,nginx,systemd, and application logs. - Printers and UPS — status and error reports.
If a product has a “Syslog server” or “Remote logging” setting, it almost certainly speaks the syslog protocol.
Next steps
Now that you know what the syslog protocol is:
- Read What is a Syslog Server? — how collection and storage work.
- Follow How to install a syslog server on Windows — set up Syslog Watcher on Windows.
- Download Syslog Watcher — try receiving syslog with a 30-day evaluation license in the installer.
For full product documentation, see the Syslog Watcher User Guide.