What is the syslog protocol?

The syslog protocol is the rule for one syslog message: how the message is written, and how a device sends it. The device does not wait to be polled. You give it an address and a port, and it sends when something happens: a denied connection, a link down, a login.

Two standards describe that message. RFC 3164 is the old one. RFC 5424 replaced it. Most firewalls and switches still send the old message.

The program that receives those messages is a syslog server. On Windows that program is a Windows syslog server, because Windows Server does not listen for syslog on its own.

Two formats you will actually see

RFC 3164

This is the old, outdated standard. Most firewalls and switches still send it. There is no year in the timestamp.

<134>Oct 11 22:14:15 switch01 %LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed state to up
  • <134> is the priority, packed into one number.
  • Oct 11 22:14:15 is the device’s clock, without a year or a timezone.
  • switch01 is the name the device put on the message. It is not always the DNS name.
  • The rest is the vendor’s text. Cisco puts a mnemonic such as %LINK-3-UPDOWN in that text. That 3 is Cisco’s own severity. It often matches syslog severity 3, and sometimes it does not.

RFC 5424

This is the standard that replaced RFC 3164. The timestamp can carry a year and a timezone, and empty fields are a single dash.

<134>1 2026-09-30T21:14:15.003Z firewall01.example.com filter - - - denied connection from 203.0.113.25

After the priority: version 1, timestamp, hostname, application name, process ID, message ID, structured data, then the text. A dash means that field was left empty.

A smart collector stores either message. You do not usually need to worry about which format arrived.

Anatomy of a syslog message
<134> Oct 11 22:14:15 firewall01 blocked connection from 203.0.113.25
Priority
<134>
Severity and facility
Timestamp
Oct 11 22:14:15
When it happened
Hostname
firewall01
Sender device
Message
blocked connection from 203.0.113.25
What happened
A syslog server parses this message so you can search and alert by field.

The priority number

<134> is facility and severity in one integer.

Divide by 8. The whole number is the facility. The remainder is the severity.

134 ÷ 8 = 16 remainder 6. Facility 16 is local0. Severity 6 is informational.

Devices usually send on local0 through local7 (facilities 16–23). The facility is a label, not a measure of importance. Severity is the part you alert on.

Syslog severity ladder
Lower numbers usually need faster attention. The remainder of the priority number is this scale.
0
Emergency
The system is unusable.
1
Alert
Act now.
2
Critical
Serious failure. A service is down.
3
Error
A failure worth an alert, once you have seen real messages from that vendor.
4
Warning
An unusual event. Keep it, and review if the count jumps.
5
Notice
A normal but important change.
6
Informational
Routine information. Store it. This is most of the volume.
7
Debug
Detailed diagnostics. Store only while you are diagnosing. It will fill the disk.

UDP, TCP, and TLS

TransportPortWhat to know
UDP514A busy link can drop datagrams. The sender will not retry. This is what most devices send by default.
TCP514, or a port the client and the server both agree onTCP is more reliable. In most cases it guarantees delivery. A lost connection is visible. The device may buffer, or drop messages, while the socket is down. Check the device.
TLS6514 is the IANA defaultTLS has all the advantages of TCP, and the session is encrypted. Certificates have to match on both ends, or the device connects and then sends nothing.

Syslog Watcher accepts all syslog transports. A new install listens on UDP 514 only. Add TCP or TLS in Network Interfaces when a device requires them.

Syslog and Windows Event Log

These are different records.

SyslogWindows Event Log
Who sends itFirewalls, switches, Linux, appliancesWindows itself and Windows applications
ShapeOne syslog message, RFC 3164 or 5424A Windows event with an ID and channels
Built into Windows ServerNo listener, including on Server 2025Yes

Windows Event Forwarding moves Event Log records between Windows computers. It still does not accept a syslog packet from a firewall. To collect those packets on Windows you install a Windows syslog server. EventLog Inspector turns Windows events into syslog so both kinds of record sit on the same collector.

What to type on the device

The device needs the collector’s IPv4 address and the port. For a default Syslog Watcher install that is UDP 514. The install guide has working examples for FortiGate and Cisco IOS.

If the device offers a facility, leave it on local0 until you have a reason to split senders by facility. Set the severity filter on the device to informational if you want the ordinary messages, or to warning if you only want the failures. Debug from a core switch will outrun a small disk.

Next

What is a syslog server? is the collector side: storage, search, and forwarding. How to install a syslog server on Windows Server is the Windows setup. Download Syslog Watcher for the installer.