Syslog
A standard protocol for sending and centralizing log messages from network devices to a server.
Syslog is a standardized protocol that lets network devices — routers, switches, firewalls, and servers — forward event and status messages to a centralized syslog server for storage and analysis. It runs over UDP port 514 by default, though many implementations also support TCP port 514 or TLS-secured TCP port 6514 for reliable, encrypted delivery. Centralizing logs makes correlating events across many devices practical and supports security auditing. A key exam distinction is that syslog is a passive, one-way logging mechanism, not an active monitoring protocol like SNMP, which polls devices and sends bidirectional traps. Severity levels run from 0 (Emergency) to 7 (Debug), and a lower number always indicates higher severity — a common point of confusion.
PlayPrepHQ study notes are written and reviewed against primary exam sources. How we create & review content →