Monitoring

Syslog

Also called rsyslog, log collector, UDP 514, RFC 5424, RFC 3164, logger, central logging

The standard way devices send log lines to a collector: one message each, on port 514.

Each message starts with a PRI number, facility × 8 + severity, then a timestamp, the sender's host name, the program's tag and the text. The old BSD format (RFC 3164) has no year or zone; RFC 5424 has a full timestamp. Over UDP a line is one unacknowledged datagram, lost if the collector is down; over TCP the sender queues and retries. The host name is the sender's claim: collectors should record the source address too, and use TLS (port 6514) where it matters.

See it on real machines

Learn it on real machines.