Syslog
A standard for devices to send log messages to a central collector.
Firewalls, switches, and servers emit events continuously. Centralizing them means the record survives even if the device is wiped, which matters when investigating an incident on the device that was attacked.
Retention length is the decision that matters most. Logs that rolled over a week ago cannot answer questions about an intrusion that started a month ago.
Where this comes up
Syslog sits inside our networks and infrastructure work. If you are trying to work out what this means for your own environment rather than in the abstract, that is the page worth reading next, and a short call will get you a straight answer faster than either.
Related terms
SIEM A system that collects logs from across your environment, correlates them, and raises alerts on suspicious patterns. Network monitoring Continuously checking that devices, links, and services are up and performing as expected. Audit log A record of who did what, when, in a system, retained so it can be reviewed later. Digital forensics Collecting and analyzing evidence from affected systems to establish what an attacker did and what they reached.