| 5.3 |  | Monitoring with Logging and Syslog |
| 5.3.5 |  | Syslog |

| In its most simplistic terms, the syslog protocol provides a transport to allow a machine to send event notification messages across IP networks to event message collectors, which are also known as syslog servers . Since each process, application, and operating system was written somewhat independently, there is little uniformity to the content of syslog messages. For this reason, no assumption is made upon the formatting or contents of the messages. The protocol is simply designed to transport these event messages. In all cases, there is one device that originates the message. The syslog process on that machine may send the message to a collector. No acknowledgement of the receipt is made.

One of the fundamental tenets of the syslog protocol and process is its simplicity. No stringent coordination is required between the transmitters and the receivers. Indeed, the transmission of syslog messages may be started on a device without a receiver being configured, or even actually physically present. Conversely, many devices will most likely be able to receive messages without explicit configuration or definitions. This simplicity has greatly aided the acceptance and deployment of syslog.

Syslog uses the UDP as its underlying transport layer mechanism. The UDP port that has been assigned to syslog is 514. It is usually recommended that the source port also be 514 to indicate that the message is from the syslog process of the sender, but there have been cases where valid syslog messages have come from a sender with a source port other than 514. If the sender uses a source port other than 514, it is usually recommended that subsequent messages be from a single, consistent port.

| Web Links The BSD syslog Protocol http://www.ietf.org/rfc/rfc3164.txt Reliable Delivery for syslog http://www.ietf.org/rfc/rfc3195.txt

Carnegie Mellon
http://www.cert.org/security-improvement/implementations/i041.08.html

Security Issues with Syslog IETF
http://www.employees.org/~lonvick/index.shtml