Syslog - collecting log messages centrally

The syslog protocol transmits log messages from devices to a syslog server, which consolidates the messages of many devices on a network. Transmission uses UDP or TCP, typically on port 514.

Each message is assigned one of eight severity levels defined by the syslog standard: 0 emergency, 1 alert, 2 critical, 3 error, 4 warning, 5 notice, 6 informational, 7 debug. A configurable log level determines the severity from which messages are recorded; the selected level and all lower ones are transmitted.

Central logging makes troubleshooting across device boundaries easier and provides the basis for audit requirements, such as documenting login events and configuration changes.