PlaybookWhat is syslog and what is a syslog server?
When to use this: Someone asks what a syslog server is, why they would need one, and what it does.
The idea in plain words
Every device writes a diary of what happens: logins, blocked connections, errors, configuration changes. Syslog is the agreed way to send each diary line across the network to one place. The place that receives and stores them is the syslog server.
FortiGate firewall ─┐
ESXi host ──────────┼──► syslog server (listens on 514) ──► files / database / search UI
Linux servers ──────┘What you get from it
- One place to look instead of logging into every device.
- Retention: keep 30, 90 or 365 days, longer than the device can.
- Evidence: logs survive even if the original device fails or is tampered with.
- A base for more: search, dashboards, alerts and compliance reports build on the stored logs.
What it is not
- Not a backup of configuration or data.
- Not automatically secure: classic syslog over UDP is unencrypted and unauthenticated. See the security scenario.
- Not a monitoring tool by itself (that needs a collector or SIEM on top).
How to verify it worked
- You can explain it in two sentences: devices send log messages over the network, and one central server stores them.
Common errors and fixes
Q&A
In one sentence, what is syslog?
A standard way for devices (firewalls, servers, switches, hypervisors) to send log messages over the network to a central place.
What is a syslog server?
Any machine running software that listens for those messages (usually on port 514) and stores them in files or a database.
Why not just read the logs on each device?
Devices keep little history, logs vanish if a device is wiped or compromised, and chasing an incident across ten consoles is slow. One central copy gives retention, search and evidence.
Is syslog only for Linux?
No. The protocol is vendor-neutral. The server can run on Linux, Windows or macOS, and the senders include almost every network and security device.