PlaybookSyslog server vs log collector vs SIEM: what is the difference?
safe beginner #siem#collector#graylog#wazuh#difference
When to use this: A customer says they need 'a syslog server', but it is unclear whether they want storage, search, or security alerts.
The ladder
| Level | What it does | Typical tools | Effort |
|---|---|---|---|
| 1. Syslog server | Receives and stores messages in files | rsyslog, syslog-ng, Visual Syslog, Kiwi Syslog | Low |
| 2. Log management / collector | Parses, indexes, searches, dashboards, simple alerts | Graylog, OpenSearch/Elastic, Grafana Loki, FortiAnalyzer | Medium |
| 3. SIEM | Correlation, detection rules, threat intel, case handling | Wazuh, Splunk ES, Microsoft Sentinel, Elastic Security | High |
How to place a request
- “We must keep logs for 90 days.” Level 1.
- “We want to search what a user did last Tuesday and see top blocked IPs.” Level 2.
- “We want to be alerted about brute force or suspicious traffic.” Level 3 (or level 2 with careful alert rules).
Start at the lowest level that satisfies the requirement. You can always add a layer later, because they all consume the same syslog stream.
How to verify it worked
- You can place a request on the ladder: store, search, or detect and alert.
Q&A
When is a plain syslog server enough?
When the need is retention and occasional manual searching (grep) of logs, for example a compliance requirement to keep 90 days.
What does a log management tool like Graylog add?
Indexing, fast search, dashboards, parsing of fields (source IP, action) and alerting. It still starts with receiving syslog.
What makes something a SIEM?
It correlates events across sources, applies detection rules, raises security alerts and supports investigation and reporting.