Syslog
Event loggingSyslog is the oldest and most universal way to say what just happened. A device emits a one-line message tagged with a facility and a severity, and ships it to a central collector — so that the evidence lives somewhere the compromised machine cannot reach.
Syslog sends one line per event, tagged by facility and severity, to a collector — off the box, where it can still be trusted.
How it works
The leading priority packs two numbers into one: facility × 8 + severity. <34> is facility 4 (auth) at severity 2 (critical) — which is how a collector routes and alerts before it has parsed a word of the message.
What Syslog does, step by step
The program picks a facility — auth, mail, kern, local0–7 — and a severity from 0 to 7.
Priority, timestamp, hostname, application and the message itself; RFC 5424 adds structured key/value data.
Sent to a collector over UDP, TCP or TLS — so it survives the machine that produced it.
The collector routes by facility and severity into storage, and raises alerts on what matters.
In cybersecurity
Logs are the evidence an investigation depends on — which makes them the first thing an intruder edits, and why plain UDP syslog can be both forged and silently dropped.
A local log on a compromised box is worth little; a copy on a collector is what survives.
No delivery guarantee at all — under load or attack, the interesting lines are the ones that vanish.
Anything can send a syslog packet claiming any hostname; use TLS on 6514 to authenticate senders.
Messages routinely contain usernames, IPs and paths, in clear text over the network by default.
Correlating events across devices is impossible if their timestamps disagree — NTP first.
Write-once storage and defined retention are what make logs admissible rather than merely present.