Syslog: What to Turn On and How to Collect It
The foundational standard, collected so nothing is lost and nothing leaks.
- Native syslog over UDP 514 drops logs silently under load and transmits in cleartext.
- The modern standard is TCP for guaranteed delivery plus TLS on port 6514 for encryption in transit.
- Never ship syslog straight from thousands of endpoints to the SIEM — stage it through aggregators (rsyslog, syslog-ng, Fluentd, Cribl Stream) in local segments or VPCs.
- Disk-assisted queues on the aggregators mean zero data loss when the central SIEM goes offline.
Syslog is the foundational logging standard for network devices (firewalls, routers, switches), Linux/Unix systems, and security appliances. It is also, in its legacy form, one of the easiest places to silently lose the evidence your SOC will need.
The problem with legacy syslog. Native syslog transmits over UDP port 514. UDP is a connectionless, stateless protocol — during a micro-burst of network traffic, or if the receiving SIEM indexer restarts, UDP logs are dropped silently and permanently lost. UDP 514 is also unencrypted cleartext, exposing sensitive log data (like usernames and URLs) to internal network packet sniffing.
The modern standard. Configure all endpoints and edge devices to send syslog via TCP (to guarantee delivery via handshake) and TLS on port 6514 (to encrypt data in transit).
Deploy dedicated forwarders — a tiered architecture. Never send syslog directly from thousands of remote endpoints over a WAN to the central SIEM. Deploy intermediate syslog aggregators — robust daemons like rsyslog or syslog-ng, or modern tools like Fluentd and Cribl Stream — within local network segments or VPCs. Configure these aggregators with disk-assisted queues: if the central SIEM goes offline for maintenance, the aggregator caches logs to its local disk and forwards them once connectivity is restored, ensuring zero data loss.
What to turn on (Linux and network devices):
- Linux AUTHPRIV (/var/log/secure or /var/log/auth.log) — sudo executions, SSH logins (successful and failed), and user creation.
- Linux AUDIT (/var/log/audit/audit.log) — requires the auditd daemon installed and configured. Critical for tracking system calls, file access, and specific command executions.
- Network devices — route state changes (BGP/OSPF), VPN authentication successes and failures, configuration changes (e.g., Cisco %SYS-5-CONFIG_I), and interface state changes.
This is exactly how Vijilan engineers ingestion for partners: reliability and coverage first, because no detection downstream can recover a log that was never delivered.
Why is native syslog over UDP 514 a problem for security operations?