A syslog server is the host that receives syslog messages that other devices send. The firewall, the switch, and the Linux host each keep a short local buffer. When that buffer rolls over, the message is gone. The syslog server keeps a copy, in one place, after the device has forgotten the message.
One message from a firewall
A firewall denies a connection and sends:
<134>Oct 11 22:14:15 firewall01 blocked connection from 203.0.113.25<134>is the priority. Divide by 8: facility 16 (local0), remainder 6 (informational). The syslog protocol page shows how that number is built.Oct 11 22:14:15is the device’s clock. The year is not in this older format, which is why the collector’s own receive time matters.firewall01is the sender.- The rest is the event.
Hours or days later you may need to search for 203.0.113.25, to find who blocked it, when, and from which firewall. The firewall’s own log is a short buffer. By the time you log in, that message may already have been overwritten. The syslog server still has it, because it kept a copy when the event was sent.
What the server does with the message
- A listener takes the packet. The usual listener is UDP port 514. TCP 514 is the reliable option. TLS, often on port 6514, encrypts the session.
- The server stores the message on its own disk.
- You search by host, time, severity, or text.
- A rule can email or forward the serious messages.
- Everything else stays in the archive. A SIEM can receive a filtered copy. The full set stays on the collector if the SIEM is down or too expensive to send every message to. See cutting a Splunk ingest bill.
That is the syslog server’s job. Dashboards and threat correlation are a SIEM’s job, usually downstream of this server.
Severity
Lower numbers are more serious. Most devices send informational (6) for ordinary events and warning (4) or error (3) when something failed. A practical split is to alert on 0–3 and keep 4–7 in the archive.
| Level | Name | Typical use |
|---|---|---|
| 0 | Emergency | The device is unusable |
| 1 | Alert | Act now |
| 2 | Critical | A service is down |
| 3 | Error | A failure, such as a denied login or a blocked connection you care about |
| 4 | Warning | Something is outside the normal range |
| 5 | Notice | A normal change, such as a saved configuration |
| 6 | Informational | Routine events |
| 7 | Debug | Detail you turn on while hunting a fault |
Vendors do not all use the same number for the same kind of event. Read a few real messages from your firewall before you build an alert on “severity 3.”
A syslog server on Windows
Windows Server does not include a syslog server role. This remains true for Windows Server 2025. Windows Event Log records events from the local operating system and its applications. It does not receive syslog from firewalls or switches. Windows Event Forwarding transfers Windows Event Log records between Windows computers. It does not accept syslog.
A Windows syslog server is the program you add to collect those syslog messages on a Windows host. What is a Windows syslog server? covers Event Log, Event Forwarding, and the Syslog Watcher services. How to install a syslog server on Windows Server is the procedure: the installer, UDP 514, and the first test message.
Syslog Watcher 7 is that server. It runs on 64-bit Windows 8.1, 10, and 11, and on Windows Server 2012 R2, 2016, 2019, 2022, and 2025.
Questions
Is syslog a server or a protocol?
Syslog is the protocol: the shape of a syslog message and how it is sent. A syslog server is the program that receives those messages, stores them, and lets you search them.
What port does a syslog server use?
The usual port is UDP 514. TCP 514 is the reliable option. Syslog over TLS commonly uses port 6514. A new Syslog Watcher install listens on UDP 514.
Do Windows servers support syslog?
Windows Server has no syslog server role, including Windows Server 2025. Windows Event Log does not receive syslog. You install a Windows syslog server such as Syslog Watcher. Details are on What is a Windows syslog server?.
Is syslog encrypted?
UDP and TCP syslog are plain text. TLS encrypts the session. Use TLS when the path crosses a network you do not trust. The usual TLS port is 6514.
What devices send syslog messages?
Firewalls, routers, switches, wireless controllers, Linux servers, VPN gateways, printers, and UPS units. A device with a “syslog server” or “remote logging” configuration field speaks this protocol.
Next
Read What is the syslog protocol? if you need the message format. Install the collector with How to install a syslog server on Windows Server. Download Syslog Watcher when you are ready to receive the first message.