PORTUnencryptedIANA assigned
Port 514Syslog
Port 514 is the traditional port for syslog, the protocol that ships log messages from routers, firewalls, Linux hosts and appliances to a central collector. UDP 514 is the classic transport; TCP 514 is common for reliability, and syslog over TLS uses TCP 6514. TCP 514 also has an older registration for the Unix rsh service.
What port 514 is used for
Syslog is the lingua franca of infrastructure logging. A device formats a message with a facility, severity, timestamp and text, and sends it to a collector. Port 514 has carried that traffic since the 1980s.
| Transport | Registration | Use |
|---|---|---|
| UDP 514 | syslog | Default for most network devices; fire-and-forget |
| TCP 514 | shell (rsh), used by convention for syslog | Reliable delivery; rsh is obsolete and rarely seen |
| TCP 6514 | syslog-tls | Syslog with TLS encryption and authentication (RFC 5425) |
Security considerations
- Syslog is unencrypted on 514. Messages often contain usernames, IP addresses, and occasionally secrets that were logged by mistake. Use TLS on 6514 across untrusted networks.
- UDP syslog can be spoofed. Anyone on the network can inject fake log lines. TLS with client certificates prevents this.
- Collectors are targets. A log server holds evidence; restrict who can reach 514/6514 and who can read the stored data.
- An unexpected 514 listener on a Windows machine is usually a syslog server product or a network monitoring suite.
Checking
netstat -ano | findstr :514Send a test message from PowerShell to confirm a collector receives UDP syslog:
$u = New-Object System.Net.Sockets.UdpClient
$b = [Text.Encoding]::ASCII.GetBytes("<14>test message from $env:COMPUTERNAME")
$u.Send($b, $b.Length, "logserver.example", 514) | Out-Null
$u.Close()Firewall considerations
Only log collectors need inbound UDP/TCP 514 (and 6514), and only from the devices that send to them. Block 514 at the internet edge.
On Windows, inbound rules live in Windows Defender Firewall with Advanced Security (wf.msc). A rule allowing port 514 only takes effect on the profile (Domain, Private, Public) it is assigned to. The command-line equivalent is netsh advfirewall firewall add rule; see the netsh record.
Frequently asked questions
Should I use UDP or TCP for syslog?
UDP is simpler and what most devices default to, but messages are silently dropped when the network or collector is busy. Use TCP (or better, TLS on 6514) for anything you rely on for security or compliance.
Does Windows send syslog?
Not natively. Windows uses the Event Log; agents such as NXLog, the Splunk forwarder or Winlogbeat translate events into syslog or ship them directly to a collector.