Protect each hop
01Syslog carries event records from an originator to a collector, sometimes through relays. TLS (Transport Layer Security) protects one connection at a time, not the truth of every event inside it.
The example event says HOSTNAME=device.example. The certificate identifies relay.example. This difference is not by itself a TLS error or proof of forgery.
Source for this drawing: RFC 5425 · Read RFC section 3 ↗
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
A relay terminates one protected hop and starts another; transport identity is not message origin.
- An originator generates content, a collector gathers it, and a relay receives then forwards it (§1.1). On each connection the transport sender is always the TLS client and the transport receiver is always the TLS server (§4.1). A relay therefore has different roles on its two connections.
- TLS supplies confidentiality, integrity checking and server or mutual authentication to counter disclosure, modification and masquerade (§§2–3). Proper authentication AND authorization of both peers are the RECOMMENDED default (§6.1). Encryption alone is insufficient.
- TLS protection is hop by hop. The authenticated peer certificate identity need not equal the RFC 5424 HOSTNAME field (§3). A collector cannot infer an original event author merely from a relay certificate.
- Denial of service and traffic analysis are explicitly outside the threats addressed here (§2). TLS transport is not an end-to-end message signature, durable-storage receipt or proof of log truth.
Fictional source and collector; two independent TLS connections, no real log data.
Read the RFC section ↗