Centralized Syslog for Networks: Architecture and Deployment

April 15, 2026·2 min read·231 words

Centralized syslog architecture for >100 devices: rsyslog/syslog-ng collector + storage (Elasticsearch, Graylog), with a minimum 1-year retention period (NIS2/PCI-DSS). SIEM integration. 2026 enterprise syslog deployment guide.

Syslog Protocol

RFC 3164 / RFC 5424
Transport: UDP 514 (unreliable), TCP 514 (reliable), or TLS 6514 (encrypted)
Facilities: 0-23 (kern, user, auth, daemon, local0-7, etc.)
Severity levels: emerg, alert, crit, err, warn, notice, info, debug

Collectors

rsyslog: Linux standard, high performance
syslog-ng: more flexible configuration
Graylog: GUI + indexing
Elastic Stack: complete ELK stack
Splunk: commercial market leader (expensive)
Microsoft Sentinel: SaaS SIEM

Cisco Configuration

logging host 10.0.0.100
logging trap informational
logging facility local0
logging source-interface Loopback0
service timestamps log datetime msec localtime

Juniper Configuration

set system syslog host 10.0.0.100 any info
set system syslog host 10.0.0.100 source-address 10.1.1.1

FortiGate Configuration

config log syslogd setting
set status enable
set server 10.0.0.100
set port 514
set facility local7
end

Storage and Retention

Volume: 1-10 GB/day per 100 devices
NIS2 / PCI-DSS retention: minimum 1 year
Hot storage: recent data (Elasticsearch)
Cold storage: >90 days (S3, Glacier)
Daily index rotation

Parsing and Enrichment

Logstash: parsing + filtering
Grok patterns: named regular expressions
GeoIP: geographic enrichment
Threat intelligence: tag suspicious IPs

Alerting

SIEM rules: Elastic Rules, Splunk Searches
Patterns: multiple failed logins, authentication anomalies
Integration: PagerDuty, Slack, email

Order from OPTINOC

Centralized syslog deployment: rsyslog + Elasticsearch + Kibana + alerting. NIS2 compliance. Quote within 48 hours.