Syslog is a standard for computer message logging. It permits separation of the software that generates messages from the system that stores them and the software that reports and analyzes them.
Syslog can be used for computer system management and security auditing as well as generalized informational, analysis, and debugging messages. It is supported by a wide variety of devices (like printers and routers) and receivers across multiple platforms. Because of this, syslog can be used to integrate log data from many different types of systems into a central repository.
Messages are labeled with a facility code (one of: auth, authpriv, daemon, cron, ftp, lpr, kern, mail, news, syslog, user, uucp, local0 ... local7) indicating the type of software that generated the messages, and are assigned a severity (one of: Emergency, Alert, Critical, Error, Warning, Notice, Info, Debug).
Implementations are available for many operating systems. Specific configuration may permit directing messages to various devices (console), files (/var/log/) or remote syslog servers. Most implementations also provide a command line utility, often called logger, that can send messages to the syslog. Some implementations permit the filtering and display of syslog messages.
Syslog was developed in the 1980s by Eric Allman as part of the Sendmail project, and was initially used solely for Sendmail. It proved so valuable that other applications began using it as well. Syslog has since become the standard logging solution on Unix and Unix-like systems; there have also been a variety of syslog implementations on other operating systems and is commonly found in network devices such as routers.
Syslog functioned as a de facto standard, without any authoritative published specification, and many implementations existed, some of which were incompatible. The Internet Engineering Task Force documented the status quo in RFC 3164. It was made obsolete by subsequent additions in RFC 5424.
Various groups are working on draft standards detailing the use of syslog for more than just network and security event logging, such as its proposed application within the health care environment.
Regulations, such as SOX, PCI DSS, HIPAA, and many others are requiring organizations to implement comprehensive security measures, which often include collecting and analyzing logs from many different sources. Syslog has proven to be an effective format to consolidate logs, as there are many open source and proprietary tools for reporting and analysis. Converters exist from Windows Event Log as well as other log formats to syslog.
An emerging area of managed security services is the collection and analysis of syslog records for organizations. Companies calling themselves Managed Security Service Providers attempt to apply analytics techniques (and sometimes artificial intelligence algorithms) to detect patterns and alert customers of problems.
A facility level is used to specify what type of program is logging the message. This lets the configuration file specify that messages from different facilities will be handled differently. The list of facilities available: (defined by RFC 3164)
|Facility Number||Keyword||Facility Description|
|5||syslog||messages generated internally by syslogd|
|6||lpr||line printer subsystem|
|7||news||network news subsystem|
|16||local0||local use 0 (local0)|
|17||local1||local use 1 (local1)|
|18||local2||local use 2 (local2)|
|19||local3||local use 3 (local3)|
|20||local4||local use 4 (local4)|
|21||local5||local use 5 (local5)|
|22||local6||local use 6 (local6)|
|23||local7||local use 7 (local7)|
The mapping between Facility Number and Keyword is not uniform over different operating systems and different syslog implementations.
For cron either 9 or 15 or both may be used.
The confusion is even greater regarding auth/authpriv. 4 and 10 are most common but 13 and 14 may also be used.
RFC 5424 defines eight severity levels:
|0||Emergency||emerg (panic)||System is unusable.||A "panic" condition usually affecting multiple apps/servers/sites. At this level it would usually notify all tech staff on call.|
|1||Alert||alert||Action must be taken immediately.||Should be corrected immediately, therefore notify staff who can fix the problem. An example would be the loss of a primary ISP connection.|
|2||Critical||crit||Critical conditions.||Should be corrected immediately, but indicates failure in a secondary system, an example is a loss of a backup ISP connection.|
|3||Error||err (error)||Error conditions.||Non-urgent failures, these should be relayed to developers or admins; each item must be resolved within a given time.|
|4||Warning||warning (warn)||Warning conditions.||Warning messages, not an error, but indication that an error will occur if action is not taken, e.g. file system 85% full - each item must be resolved within a given time.|
|5||Notice||notice||Normal but significant condition.||Events that are unusual but not error conditions - might be summarized in an email to developers or admins to spot potential problems - no immediate action required.|
|6||Informational||info||Informational messages.||Normal operational messages - may be harvested for reporting, measuring throughput, etc. - no action required.|
|7||Debug||debug||Debug-level messages.||Info useful to developers for debugging the application, not useful during operations.|
A common mnemonic used to remember the syslog levels from bottom to top is: "Do I Notice When Evenings Come Around Early".
Format of a Syslog packet
The full format of a Syslog message seen on the wire has three distinct parts:
<PRI> HEADER MSG
The total length of the packet cannot exceed 1,024 bytes, and there is no minimum length
The PRI part is a number that is enclosed in angle brackets. This represents both the Facility and Severity of the message. This number is an eight bit number. The first 3 least significant bits represent the Severity of the message (with 3 bits you can represent 8 different Severities) and the other 5 bits represent the Facility of the message. You can use the Facility and the Severity values to apply certain filters on the events in the Syslog Daemon. Note that Syslog Daemon cannot generate these Priority and Facility values. They are generated by the applications on which the event is generated. Following are the codes for Severity and Facility. Please note that the codes written below are the recommended codes that the applications should generate in the specified situations. You cannot, however, be 100 % sure if it really is the correct code sent by the application. For example: An application can generate a numerical code for severity as 0 (Emergency) when it should have generated 4 (Warning) instead. Syslog Daemon can not do anything about it!! It will simply receive the message as it is.
Calculating Priority Value
The Priority value is calculated by first multiplying the Facility number by 8 and then adding the numerical value of the Severity. For example, a kernel message (Facility=0) with a Severity of Emergency (Severity=0) would have a Priority value of 0. Also, a "local use 4" message (Facility=20) with a Severity of Notice (Severity=5) would have a Priority value of 165. In the PRI part of a Syslog message, these values would be placed between the angle brackets as <0> and <165> respectively.
The HEADER part contains the following things:
- Timestamp -- The Time stamp is the date and time at which the message was generated. Be warned, that this timestamp is picked up from the system time and if the system time is not correct, you might get a packet with totally incorrect time stamp
- Hostname or IP address of the device.
The MSG part will fill the remainder of the Syslog packet. This will usually contain some additional information of the process that generated the message, and then the text of the message. The MSG part has two fields:
- TAG field
- CONTENT field
The value in the TAG field will be the name of the program or process that generated the message. The CONTENT contains the details of the message.
||This section possibly contains original research. (December 2013)|
Since Syslog protocol is UDP based, it is unreliable. It does not guarantee you the delivery of the messages. They may either be dropped through network congestion, or they may be maliciously intercepted and discarded. The Syslog protocol does not ensure ordered delivery of packets.
Since each process, application and operating system was written independently, there is little uniformity to the content of syslog messages. For this reason, no assumption is made upon the formatting or contents of the messages. The protocol is simply designed to transport these messages.
The receiver of a Syslog packet may not be able to authenticate that the message was indeed sent from the reported sender. A misconfigured machine may send syslog messages to a Syslog daemon representing itself as another machine. The administrative staff may become confused because the status of the supposed sender of the messages may not be accurately reflected in the received messages. Another problem associated with authentication is that an attacker may start sending fake messages indicating a problem on some machine. This may get the attention of the system administrators who will spend their time investigating the alleged problem. During this time, the attacker may be able to compromise a different machine, or a different process on the same machine. An attacker may record a set of messages that indicate normal activity of a machine. At a later time, that attacker may remove that machine from the network and replay the syslog messages to the daemon.
Syslog is a client/server protocol: a logging application transmits a maximum 1024-byte text message to the syslog receiver. The receiver is commonly called syslogd, syslog daemon or syslog server. Syslog messages may be sent via the User Datagram Protocol (UDP) or the Transmission Control Protocol (TCP). The data is sent in cleartext; although not part of the syslog protocol itself, an SSL wrapper may be used to provide for a layer of encryption through SSL/TLS. Syslog uses the port number 514.
The Syslog protocol is defined by Request for Comments (RFC) documents published by the Internet Engineering Task Force (Internet standards). The following is a list of RFCs that define the Syslog protocol:
- RFC 3164 The BSD syslog Protocol (obsoleted by RFC 5424)
- RFC 3195 Reliable Delivery for syslog
- RFC 5424 The Syslog Protocol
- RFC 5425 TLS Transport Mapping for Syslog
- RFC 5426 Transmission of Syslog Messages over UDP
- RFC 5427 Textual Conventions for Syslog Management
- RFC 5848 Signed Syslog Messages
- RFC 6012 Datagram Transport Layer Security (DTLS) Transport Mapping for Syslog
- RFC 6587 Transmission of Syslog Messages over TCP
- Gerhards R. "RFC 5424". The Syslog Protocol.
- "LXer: Patent jeopardizes IETF syslog standard".
- "IETF IPR disclosure on HUAWEI's patent claims".
- "Syslog Facility". Retrieved 22 November 2012.
- "Syslog Facilities". Retrieved 15 February 2012.
- "The Ins and Outs of System Logging Using Syslog".
- RFC 3164, The BSD syslog Protocol
- RFC 3195, Reliable Delivery for syslog
- "Security Issues in Network Event Logging (syslog)". IETF.
- IETF syslog working group
- SANS Paper The Ins and Outs of System Logging Using Syslog
- NIST SP 800-92 Guide to Computer Security Log Management (PDF)
- NetLogger methodology and tools for debugging and analysis of complex distributed applications