PlaybookFacility, severity, ports and protocols (UDP, TCP, TLS)
When to use this: You need to read a syslog message header, pick a port, or decide between UDP, TCP and TLS.
Priority (the <190> at the start)
Every message starts with a number in angle brackets: PRI = facility x 8 + severity.
| Severity | Name | Meaning |
|---|---|---|
| 0 | emergency | System unusable |
| 1 | alert | Act immediately |
| 2 | critical | Critical condition |
| 3 | error | Error |
| 4 | warning | Warning |
| 5 | notice | Normal but significant |
| 6 | informational | Routine information |
| 7 | debug | Debug detail |
Common facilities: 0 kern, 1 user, 3 daemon, 4 auth, 10 authpriv, and 16 to 23 = local0 to local7. Network devices usually let you choose a local facility so you can route their logs to a separate file.
Ports and transports
| Port | Protocol | Standard | Use |
|---|---|---|---|
| 514 | UDP | RFC 5426 | Classic syslog. Fast, no delivery guarantee, no encryption |
| 514 | TCP | RFC 6587 | Reliable delivery, still unencrypted |
| 6514 | TCP + TLS | RFC 5425 | Encrypted and authenticated |
| 601 | TCP | RFC 3195 reliable syslog | Seen as a FortiGate FIPS-CC default |
| 1514, 5514 | any | none | Common non-privileged alternatives (ports under 1024 need root on Linux and macOS) |
Which to choose
- Lab or trusted LAN: UDP 514 is fine.
- Logs you cannot afford to lose, or high volume: TCP.
- Across the internet or untrusted networks: TLS, or send through a VPN tunnel (see the security scenario).
How to verify it worked
- Given
<190>, you can say it is facility 23 (local7), severity 6 (informational).
Q&A
How is the number in <190> calculated?
PRI = facility x 8 + severity. 190 = 23 x 8 + 6, so facility local7, severity informational.
Which severity number is the most serious?
0 (emergency). Lower numbers are more severe; 7 (debug) is the least.
UDP or TCP for syslog?
UDP is simple and light but can silently lose messages. TCP retries and orders messages, so use it when losing logs matters. TLS adds encryption and server authentication.
What is the difference between RFC 3164 and RFC 5424?
3164 is the older informal BSD format (no year or time zone, loosely defined). 5424 is the newer standard with an ISO timestamp, structured data and a clearer header. Many devices still send 3164-style lines.