Syslog / secure syslog
Syslog transports event records to a collector. Message format and transport are separate choices; UDP delivery can be lost, and TLS requires compatible trust and framing.
Scope: Syslog / secure syslog — requirements depend on the selected profile.
protocol · Catalog reviewed 2026-09-27
InfrastructureOpen Standard
Infrastructure Requirements
- Reachable collector using the selected transport and message format
- compatible TLS trust/framing where secured transport is selected.
Network & Physical Requirements
| Port / allocation | Transport | Connection / signal flow | Feature and requirement | Evidence |
|---|---|---|---|---|
| 514 | UDP | Device / relay → Log collector | Profile requirement · Core Syslog datagrams Syslog UDP mapping | Source checked 2026-09-27 RFC 5426, Section 3.3: Source and Target Ports |
| 6514 | TCP | Device / relay → TLS log collector | Optional · TLS Syslog over TLS Syslog TLS mapping | Source checked 2026-09-27 RFC 5425, Sections 4.1 and 4.2: Port Assignment and Initiation |
Gotchas & IT Notes
- ⚠Size log retention and event rates; synchronize clocks. Plain TCP 514 is implementation-specific, not the TLS mapping.