L15
Syslog, event severity and SIEM
Cram this first — memory hook
Logs are the diary; Syslog delivers it; Security Information and Event Management compares many diaries. 514 = five events, one timeline, four clues.
Exam trap
More verbose does not mean more severe: Debug 7 is not more urgent than Emergency 0.
The slide facts
Syslog sends device event records to a collector, commonly on User Datagram Protocol 514. Severity codes run from 0 to 7. correlates logs across devices to reveal patterns.
If you have time — extra
A log records something that happened: a failed sign-in, interface change, blocked connection or restart. Syslog is a common way to send those records to a central collector. User Datagram Protocol () 514 is a familiar default; it does not provide Transmission Control Protocol -style delivery assurance or encryption. A Security Information and Event Management () system can parse, normalize and correlate records, making patterns easier to see than individual log lines. It is like collecting several cameras' footage and comparing timelines. Correct time matters, so Network Time Protocol () is an important dependency. Severity is ordered 0 Emergency, 1 Alert, 2 Critical, 3 Error, 4 Warning, 5 Notice, 6 Informational, 7 Debug. A lower number means greater severity; product-specific messages still require context.
Walkthrough
A device creates an event, sends a record to the collector, the monitoring system prioritizes or correlates it, and the technician investigates the evidence. Logging without review or alert handling is incomplete.