Centralized Syslog for Networks: Architecture and Deployment

Centralized syslog architecture for >100 devices: rsyslog/syslog-ng collector + storage (Elasticsearch, Graylog), with a minimum 1-year retention period (NIS2/PCI-DSS). SIEM integration. 2026 enterprise syslog deployment guide.

Syslog Protocol

• RFC 3164 / RFC 5424
• Transport: UDP 514 (unreliable), TCP 514 (reliable), or TLS 6514 (encrypted)
• Facilities: 0-23 (kern, user, auth, daemon, local0-7, etc.)
• Severity levels: emerg, alert, crit, err, warn, notice, info, debug

Collectors

• rsyslog: Linux standard, high performance
• syslog-ng: more flexible configuration
• Graylog: GUI + indexing
• Elastic Stack: complete ELK stack
• Splunk: commercial market leader (expensive)
• Microsoft Sentinel: SaaS SIEM

Cisco Configuration

• logging host 10.0.0.100
• logging trap informational
• logging facility local0
• logging source-interface Loopback0
• service timestamps log datetime msec localtime

Juniper Configuration

• set system syslog host 10.0.0.100 any info
• set system syslog host 10.0.0.100 source-address 10.1.1.1

FortiGate Configuration

• config log syslogd setting
• set status enable
• set server 10.0.0.100
• set port 514
• set facility local7
• end

Storage and Retention

• Volume: 1-10 GB/day per 100 devices
• NIS2 / PCI-DSS retention: minimum 1 year
• Hot storage: recent data (Elasticsearch)
• Cold storage: >90 days (S3, Glacier)
• Daily index rotation

Parsing and Enrichment

• Logstash: parsing + filtering
• Grok patterns: named regular expressions
• GeoIP: geographic enrichment
• Threat intelligence: tag suspicious IPs

Alerting

• SIEM rules: Elastic Rules, Splunk Searches
• Patterns: multiple failed logins, authentication anomalies
• Integration: PagerDuty, Slack, email

Order from OPTINOC

Centralized syslog deployment: rsyslog + Elasticsearch + Kibana + alerting. NIS2 compliance. Quote within 48 hours.