SYSLOG

Question 1

What is syslog?

Answer 1

A protocol for enabling different appliances and software to transmit logs to a server.

Note: syslog can refer to the protocol, the server, or the log entries themselves

Question 2

What is the name of the standard for logging of events from distributed systems called?

Answer 2

The Client-Server Model

Question 3

What Port does syslog use?

Answer 3

Port 514 UDP

Question 4

What is contained in a syslog message?

Answer 4

PRI code (Priority Code)
Header
Message Portion

Question 5

What is contained in the PRI code?

Answer 5

PRI code is a calculation from the facility and severity level of the data

Question 6

What is contained in the Header

Answer 6

The time-stamp of the event and hostname.

Question 7

What is contained in the message portion?

Answer 7

The source process of the event and related content. Essentially, what happened, and what do we need to know?

Question 8

What was the problem with the original syslog?

Answer 8

Because it was UDP, there were sometimes delivery problems on congested networks. No encryption or authentication.

Question 9

What are the improvements for newer syslog?

Answer 9

Port 1468 TCP
Uses TLS for confidentiality
Uses MD-5 or SHA-1 for authentication and integrity

Question 10

What is the newer version of syslog server called?

Answer 10

syslog-ng or rsyslog