Network Interfaces

A network interface is a listener on a local IP address and port that accepts syslog messages. Each interface uses one transport: UDP, TCP, or TLS. Several interfaces can run at once (for example UDP for older devices and TLS for encrypted sources).

The collector needs at least one active interface or it receives nothing.

Managing Network Interfaces

Network interfaces are configured in Syslog Collector Configuration.

On the Server toolbar, click collector Collector → Syslog Collector Configuration…​, then open the Network Interfaces tab.

Syslog Collector Configuration — Network Interfaces tab

Leave the advanced settings unchanged unless a specific problem requires a change.

UDP Interface

UDP is the usual syslog transport. It is connectionless: originators send datagrams with no session. Port 514 is the IANA default (RFC 5426).

UDP is simple and widely supported, but delivery is not guaranteed and the payload is not encrypted. Use it when compatibility matters more than lossless, private transport.

Adding a UDP Interface

  1. Click Add UDP Interface.

  2. Set a local IPv4 or IPv6 address, or 0.0.0.0 / ::0 for all addresses of that family.

  3. Keep port 514, or set the port the originators send to.

  4. Click Apply.

Syslog Collector Configuration - UDP Network Interface

TCP Interface

TCP adds a persistent connection, ordered delivery, and flow control. Port 514 is the IANA default (RFC 6587) — same number as UDP, different protocol.

The originator must speak syslog over TCP. There is still no encryption. Use TCP when loss on the path is not acceptable.

Adding a TCP Interface

  1. Click Add TCP Interface.

  2. Set address and port the same way as described for the UDP interface.

  3. Limit the maximum number of concurrently connected TCP clients and specify the behavior when this limit is exceeded.

  4. Click Apply.

If Replace older connections is off, new clients are refused when the limit is reached.
Syslog Collector Configuration - TCP Network Interface

TLS Interface

TLS encrypts syslog over TCP. Port 6514 is the IANA default (RFC 5425).

The collector presents a server certificate; originators can be required to present client certificates. Use TLS when the path must not carry logs in clear text. Setup is in Syslog over TLS.

Adding a TLS Interface

  1. Click Add TLS Interface.

  2. Set address, port, and a maximum number of connections the same way as described for the TCP interface.

  3. Configure TLS options (certificate and key) as described in Syslog over TLS.

  4. Click Apply.

Syslog Collector Configuration - TLS Network Interface

Choosing Port Numbers

Usual ports are UDP/TCP 514 and TLS 6514. The collector must listen on the same port the originators send to.

Firewalls and security groups on the path must allow that port and protocol.

UDP and TCP (or UDP and TLS) can share a port on the same address because they are different transports. Example: UDP 514 and TCP 514 together.

TCP and TLS cannot share the same address and port. TLS is encrypted TCP, so they would compete for one listener. Use different ports (TCP 514 and TLS 6514) or different bind addresses.