PlaybookAnswer 'what is syslog?' to a customer (ready-made answers)
When to use this: A customer or colleague asks the typical questions and you want short, correct answers.
Use the Q&A below as your cheat sheet. They also appear as flashcards in the Learn section.
The 20-second version: “A syslog server is a central place where your firewall, servers and VMware hosts send their logs, so you can keep them, search them and prove what happened. It runs on Linux, Windows or macOS, in a VM or in the cloud. The best choice depends on how many devices you have, how long you must keep logs and whether you need dashboards or alerts.”
Q&A
What is a syslog server?
A central machine that receives log messages from firewalls, servers and other devices and keeps them, usually listening on port 514.
Can it be installed on Windows, Linux or macOS?
Yes, all three. Linux (Ubuntu with rsyslog) is the most common and lightest. Windows needs a dedicated application such as Kiwi Syslog Server or Visual Syslog Server. macOS works for a lab but is not a good always-on server.
Can it run on VMware?
Yes. A small Ubuntu VM on VMware Workstation or ESXi is a very common choice. Use a bridged or LAN network so the firewall can reach it, and give it a fixed IP.
How do I connect a FortiGate?
Point the FortiGate's syslog setting (config log syslogd setting) at the server's IP, port and protocol, make sure the policies actually log, and allow the port on the server's firewall.
Can it run on my own PC?
For a lab, yes. For production, no: the PC sleeps, reboots and changes IP, and every gap is lost logs. Use a VM, a small server or a cloud instance that stays on.
Can it run in the cloud, for example on AWS?
Yes, an EC2 instance works. Do not expose port 514 to the whole internet: allow only your firewall's IP, or better, send logs through a VPN tunnel.
What is the best solution?
It depends on size, budget and what you want to do with the logs. For plain retention, rsyslog on Ubuntu (free). For searchable dashboards, Graylog Open. For Fortinet-only estates with budget, FortiAnalyzer. Use the decision helper.
How much will it cost?
The software can be free. The real costs are the machine (a small cloud VM is on the order of tens of dollars a month), disk for the retention period, and admin time. See the cost scenario.
How much disk do I need?
Events per second x average message size x 86,400 x days of retention. Measure your real volume for a day first.