What Is Syslog?
Syslog is the standard protocol network devices use to send log messages to a central server. Every message carries a severity level from 0 (emergency) to 7 (debug), so you can filter the noise and act on what matters.
The 8 severity levels
| Level | Severity | Meaning |
|---|---|---|
| 0 | Emergency | System unusable |
| 1 | Alert | Act immediately |
| 2 | Critical | Critical condition |
| 3 | Error | Error condition |
| 4 | Warning | Warning condition |
| 5 | Notice | Normal but notable |
| 6 | Informational | Informational message |
| 7 | Debug | Debug-level detail |
Lower number = more severe. Memory trick: Every Awesome Cisco Engineer Will Need Ice-cream Daily (Emergency, Alert, Critical, Error, Warning, Notice, Informational, Debug).
How syslog works
Devices generate messages (an interface goes down, a config changes) and send them over UDP 514 to a syslog server that stores and indexes them. You set a logging level and the device sends that level and everything more severe — set level 4 and you get warnings up through emergencies, but not routine info/debug.
Why centralised logging matters
Logs scattered across 100 devices are useless in an incident. A central syslog server (often feeding a SIEM) gives one timeline to correlate events, essential for troubleshooting and security monitoring. Always pair syslog with SNMP/NTP-synced clocks so timestamps line up.
Frequently asked questions
What is syslog?
A standard protocol that network devices use to send log messages to a central server. Each message has a severity level from 0 (emergency) to 7 (debug).
What are the syslog severity levels?
Eight levels, 0 to 7: Emergency, Alert, Critical, Error, Warning, Notice, Informational and Debug. Lower numbers are more severe.
What port does syslog use?
Traditionally UDP port 514. Secure implementations can use TLS over TCP for reliable, encrypted log delivery.
Why is centralised logging important?
It collects logs from all devices into one place, giving a single correlated timeline that is essential for troubleshooting and security monitoring — often feeding a SIEM.
Related articles
Want hands-on training?
Learn this on real Cisco lab devices with placement support at Attila Technologies, Ahmedabad.