How Syslog Works: Log Forwarding to a SIEM, Severity & Log Tampering (Animated)

Syslog is how firewalls, routers, Linux servers and many applications send their logs to a central place, usually a SIEM. It is the raw material of every SOC alert, which is exactly why attackers try to erase or flood it.

1. Send a log: priority, timestamp, host, message

Each syslog line starts with a priority value that encodes the facility (what produced it) and the severity (how bad it is).

1. SYSLOG (Firewall → SIEM / log collector): The firewall reports a blocked connection attempt.
2. SYSLOG (Web server → SIEM / log collector): The web server reports a failed SSH login.

Wireshark filter:

syslog

2. Correlate: the siem connects the dots

One failed login means little. The SIEM notices the same address being blocked at the firewall and failing logins on the server, many times a minute, and raises one alert.

1. SYSLOG (Web server → SIEM / log collector): The pattern builds up.
2. ALERT (SIEM / log collector → SIEM / log collector): An analyst gets a single, meaningful alert.

Example siem rule:

> 20 “Failed password” from one IP in 5 min → alert (brute force)

3. Hiding the tracks: attack: delete or drown the logs

An intruder on the server deletes local log files and stops the logging service. With plain UDP syslog there is no delivery confirmation, so messages that were never sent, or are lost, leave a silent gap.

1. SYSLOG (Attacker → SIEM / log collector): If logs only lived on the server, the evidence is gone.

What to watch for:

Sudden silence from a host · “log file cleared” events (Windows Event ID 1102)

4. Forward in real time: defence: the evidence is already elsewhere

Forward logs the instant they are written, over TCP with TLS, to a collector the server’s admins can’t edit. Alert when a host goes quiet, and keep collectors on a separate, locked-down network.

1. SYSLOG/TLS (Web server → SIEM / log collector): Every action was already forwarded before the attacker started deleting.
2. ALERT (SIEM / log collector → SIEM / log collector): The silence itself triggers an alert, and the earlier logs are safe.

Rsyslog.conf:

action(type="omfwd" target="10.0.0.50" port="6514" protocol="tcp" StreamDriver="gtls" StreamDriverMode="1")

FAQ