Syslog

 System Logging Protocol (Syslog) is a way network devices can use a standard message format to
communicate with a logging server.
 It was designed specifically to make it easy to monitor network devices.
 Devices can use a Syslog agent to send out notification messages under a wide range of specific
conditions Syslog transmission
 Traditionally, Syslog uses the UDP protocol on port 514 but can be configured to use any port. In
addition, some devices will use TCP 1468 to send syslog data to get confirmed message delivery.
 Syslog packet transmission is asynchronous.
 What causes a syslog message to be generated is configured within the router, switch, or server itself.
 Unlike other monitoring protocols, such as SNMP, there is no mechanism to poll the syslog data.
 In some implementations, SNMP may be used to set or modify syslog parameters remotely.
 The syslog message consists of three parts: PRI (a calculated priority value), HEADER (with identifying
information), and MSG (the message itself).

 The PRI data sent via the syslog protocol comes from two numeric values that help categorize the
message.
 The first is the Facility value. This value is one of 15 predefined values or various locally defined values
in the case of 16 to 23. These values categorize the type of message or which system generated the
event.

Type of Syslog Server Messages

Number Facility description

0 Kernel messages
1 User-level messages
2 Mail System
3 System Daemons
4 Security/Authorization Messages
5 Messages generated by syslogd
6 Line Printer Subsystem
7 Network News Subsystem
8 UUCP Subsystem
9 Clock Daemon
10 Security/Authorization Messages
11 FTP Daemon
12 NTP Subsystem
13 Log Audit
14 Log Alert
15 Clock Daemon
The second label of a syslog message categorizes the importance or severity of the message in a numerical
code from 0 to 7.
Code Severity
0 Emergency
1 Alert
2 Critical
3 Error
4 Warning
5 Notice
6 Info
7 Debug
How to configure syslog server?
Description
System is unusable
Action must be taken immediately
Critical conditions
Error conditions
Warning conditions
Normal but significant condition
Informational messages
Debug-level messages