syslog
termnetworkingIT support
The universal log-shipping protocol: devices stream timestamped severity-tagged events to a central collector, from debug chatter to emergencies.
RFC 5424 formalized what BSD improvised; severity 0 is Emergency, 7 is Debug, and both get ignored at 3 a.m.
Syslog is the lowest common denominator of machine logging, and its longevity comes from being simple enough that everything implements it. A message carries a facility, a severity, a timestamp, a hostname, and free text. That is nearly the whole protocol, which is both why it is universal and why parsing it consistently is harder than it looks.
The priority value is the part people decode wrong. It is a single number encoding both facility and severity, computed as facility times eight plus severity, so recovering the two requires arithmetic rather than reading. Severity ordering is also counterintuitive: zero is emergency and seven is debug, so lower numbers are more urgent, and filters written the intuitive way silently drop the messages that mattered.
Transport is where the operational risk sits. Classic syslog is UDP, which means messages are unacknowledged and can be lost precisely when a device is under the stress you most want logged. TCP and TLS transports fix delivery and confidentiality, and the reason to care is that logs are the evidence for an incident that has not happened yet: a gap in them is discovered at the worst possible moment.