Syslog Fundamentals

For more details, visit https://docs.logzilla.net/04_Administration/05_Syslog_Basics/

#syslog is a client/server protocol originally developed in the 1980s by Eric Allman as part of the Sendmail project.

The original syslog is defined within the syslog working group of the IETF RFC 3164 and is supported by a wide variety of devices and receivers across multiple platforms.

Senders
A syslog sender can be any type of device or software such as a Cisco, Juniper, HP, etc. networking device, Operating Systems, and/or individual applications such as Antivirus Software, Web Servers, etc.

If the sender is using an RFC 3164 compliant format (the most common), it sends a small (less than 1KB) text message to the syslog receiver.

UDP Senders
Since UDP is, by design, "connection-less", it does not provide acknowledgments to the sender or receiver. Consequently, the sending device generates syslog messages without knowing whether the syslog receiver has actually received the messages. In fact, UDP-based senders will send events out even if the syslog server does not exist at the configured destination. Using UDP provides no "guarantee" of reception. For this reason, many (if not all) syslog senders will repeatedly send the same events over and over.

TCP Senders
Many of today's devices, software, etc. can be configured to send using TCP instead of UDP in order to help ensure a more "guaranteed" delivery to the receiver. This is due to the TCP protocol's design in that it will establish a connection on both ends and allow for "handshakes" where both sender and receiver are aware that a message was both sent and acknowledged. When given the option, all systems capable of sending via TCP instead of UDP should be configured to do so.


Receiver
A syslog receiver, typically referred to as a "syslog daemon" listens on incoming network ports using UDP (typically on port 514/udp) or TCP (typically, port 514/tcp). While there are some exceptions such as TLS encryption, syslog data is sent in clear text over the network.

LogZilla utilizes Balabit's industry-standard syslog-ng daemon to receive messages and forward them to LogZilla's architecture.

Relays
Relays are used to forward logs from local networks to remote networks.