Syslog
Syslog is the standard protocol for network device log collection. Devices (routers, switches, firewalls) send log messages to a central syslog server using UDP port 514 (or TCP 514/6514 for reliable/encrypted syslog). Log messages include: timestamp, hostname, facility (source category), severity level, and message text.
Syslog severity levels (0–7): 0=Emergency (system unusable), 1=Alert (immediate action needed), 2=Critical, 3=Error, 4=Warning, 5=Notice (significant but normal), 6=Informational, 7=Debug (very verbose). Mnemonic: 'Every Awful Crisis Eventually Worsens Nightly Internally Downward.' Lower number = higher severity. Configure devices to log at appropriate severity — avoid Debug in production (too much data).
Local logging: devices store logs in local memory/flash — lost on reboot. Remote syslog: sends logs to a dedicated syslog server for persistence and aggregation. Syslog servers: rsyslog, syslog-ng (Linux), Kiwi Syslog (Windows). Central logging enables correlation — seeing events from multiple devices in one place.
SIEM Systems
SIEM (Security Information and Event Management): collects logs from diverse sources (network devices, servers, endpoints, applications, cloud services), normalizes the data, and correlates events across sources to detect security incidents. SIEM provides: real-time alerting on security events, historical search for forensic investigation, compliance reporting, and dashboards.
SIEM examples: Splunk, IBM QRadar, Microsoft Sentinel (cloud), Elastic SIEM (open source). SIEM correlation: if a firewall blocks a connection AND the endpoint generates an AV alert within seconds from the same source, the SIEM correlates these into a single incident alert — pattern recognition across multiple log sources.
Log Retention and Security
Log retention: how long logs are kept. Compliance regulations specify minimum retention — PCI DSS requires 12 months (3 months immediately accessible), HIPAA requires 6 years. Security investigations often need logs from weeks or months ago. Plan storage accordingly — high-volume devices can generate gigabytes of logs per day.
Log integrity: logs are only useful as evidence if they haven't been tampered with. Use write-once storage, WORM (Write Once Read Many) media, or cryptographic hashing to ensure log integrity. Centralized logging also removes attacker access to local logs — an attacker who compromises a device cannot easily delete centralized logs.