RFC 5425 / START HERE
Syslog over TLS, before the details
TLS means Transport Layer Security. RFC 5425 maps syslog, the sending of event records, onto protected TLS connections.
A log sender connects to a log receiver, checks its permitted peer, and sends length-prefixed event messages through TLS. A relay ends one TLS connection and begins another.
The idea in one picture
Log sender
Protected hop
Log receiver
A simplified picture of the idea; the chapters explain the actual mechanisms.
Why it exists
It addresses disclosure, alteration and impersonation between neighboring log systems. It adds transport protection to the RFC 5424 message format. RFC 9662 updates its cipher and version requirements and forbids TLS early data.
A familiar example
For example, a fictional router sends an event to a relay on the default TCP port 6514. The relay forwards it to a collector using a separate secure connection. The collector knows its TLS peer, not necessarily the original event author; there is no application delivery receipt.
Helpful background
You can start here without reading another RFC. If these ideas are unfamiliar, these short introductions may help.
What you’ll learn next
Begin with chapter one, or choose a topic.
- Protect each hopSyslog carries event records from an originator to a collector, sometimes through relays. TLS (Transport Layer Security) protects one connection at a time, not the truth of every event inside it.→
- Handshake before logsThe sender opens TCP to the receiver, normally on port 6514, then starts TLS. The handshake exchanges options, checks peers and establishes protection keys. Finish the handshake and satisfy peer policy before sending syslog application data. Later RFC 9662 updates the cryptographic requirements.→
- Authorize the peerAuthentication checks which peer holds a key. Authorization checks whether that peer is allowed here. A trusted issuer alone is not a list of authorized log servers.→
- Frame application dataTLS records protect chunks of bytes. A syslog message may cross record boundaries, and one record may contain several messages. A decimal octet count tells the receiver how many message bytes to consume.→
- Close without a receiptclose_notify is a TLS alert announcing closure. It is not an application receipt saying that an event was analyzed or saved. On a broken connection the sender can be uncertain which events arrived.→
This introduction explains RFC 5425 (2009). Read the original RFC ↗