Syslog

Syslog is a protocol used to send system log or event messages to a specific server. It is supported by a wide range of devices and operating systems, making it a universal choice for collecting logs from network infrastructure, security appliances, and Unix-based systems.

The protocol supports both UDP (for lightweight, fire-and-forget logging) and TCP (for reliable delivery with acknowledgments). Many network devices, firewalls, routers, and switches support syslog natively without requiring additional software.

Data Flow

The following diagram shows how syslog data flows through Log Collector's ingestion pipeline:

flowchart LR A[Network Devices] --> B[Syslog Protocol] B --> C[LogScale Syslog Listener] C --> D[Parser Pipeline] subgraph "Parser Types" D --> D1[Syslog RFC3164 Parser] D --> D2[Syslog RFC5424 Parser] D --> D3[CEF Parser] D --> D4[Custom Syslog Parser] end D1 & D2 & D3 & D4 --> E[Compression] E --> F[Repository Storage]
flowchart LR A[Network Devices] --> B[Syslog Protocol] B --> C[LogScale Syslog Listener] C --> D[Parser Pipeline] subgraph "Parser Types" D --> D1[Syslog RFC3164 Parser] D --> D2[Syslog RFC5424 Parser] D --> D3[CEF Parser] D --> D4[Custom Syslog Parser] end D1 & D2 & D3 & D4 --> E[Compression] E --> F[Repository Storage]

LogScale can receive syslog messages through ingest listeners or via the LogScale Collector configured to accept syslog input. The system automatically parses standard syslog formats and extracts structured fields for analysis.