Syslog
| Typically Used By | Organizations with existing syslog infrastructure; Network device monitoring |
| Description | A standard protocol for message logging that enables collection from network devices and security infrastructure without requiring an agent. |
| Official Vendor Documentation | https://datatracker.ietf.org/doc/html/rfc5424 |
| Setup Difficulty | 2 (Low) |
| Useful for | IT Ops , SecOps |
| Primary Use Case | Collect logs from network and security devices |
| Scenarios not Recommended | Environments requiring strong authentication; Situations where logs contain sensitive data without encryption |
| Data Volume Handling | High |
| Authentication Method | None or TLS |
| Fault Tolerance | Medium |
| Additional Tools Required | Syslog server |
Syslog is a protocol used to send system log or event messages to a specific server, known as a syslog server. It is supported by a wide range of devices and operating systems, making it a universal choice for log aggregation. The LogScale Collector can receive and process syslog messages in both TCP and UDP syslog streams from your infrastructure, enabling real-time visibility and analysis of your infrastructure logs.
Syslog ingest flowThe following diagram shows how Syslog log data flows through Log Collector's ingestion pipeline:
Source Systems (servers, network devices, appliances) send syslog messages (via TCP or UDP)
LogScale Collector receives these syslog streams
The Parser Pipeline processes the raw syslog data (using built-in or custom parsers)
Data is compressed, stored in the repository, and indexed for searching