↓ Skip to main content
KAZULOG.INFO
  1. Linux Articles/
  2. Ubuntu 26.04 LTS Server/

Setting Up a syslog Server on Ubuntu 26.04 LTS Server (rsyslog)

Table of Contents

Before setting up a syslog server

This article builds a server that collects logs from routers, switches and other servers in one place, using Ubuntu’s rsyslog. rsyslog is installed and running on Ubuntu 26.04 from the start, but receiving logs from other hosts is switched off. Here we enable receiving and have a router and another server send their logs.

A syslog message carries a facility (what kind of program it came from) and a severity, combined into one number called PRI (PRI = facility × 8 + severity). It normally travels over UDP port 514, and TCP can be used as well.

ItemDetails
Files edited on the receiver/etc/rsyslog.conf (enabling reception and restricting senders), /etc/rsyslog.d/*.conf (extra settings)
File edited on the sender/etc/rsyslog.conf (forwarding)
PortsUDP 514, TCP 514
Message formatsRFC 3164 (BSD style) and RFC 5424 (the newer one)

Finding the configuration files

rsyslog is already installed, and the service is running.

Checking the package - example
kazulog@sv1:~$ apt-cache policy rsyslog | head -3
rsyslog:
  Installed: 8.2512.0-1ubuntu4.1
  Candidate: 8.2512.0-1ubuntu4.1
kazulog@sv1:~$ apt-cache show --no-all-versions rsyslog | grep -E '^(Version|Section|Priority):'
Priority: important
Service state - example
kazulog@sv1:~$ systemctl status rsyslog --no-pager | head -6 | cat
● rsyslog.service - System Logging Service
     Loaded: loaded (/usr/lib/systemd/system/rsyslog.service; enabled; preset: enabled)
     Active: active (running) since Sat 2026-09-12 08:23:00 JST; 5min ago
 Invocation: 13a9a0a695b14b73b2d9c064a636dacb
TriggeredBy: ● syslog.socket
       Docs: man:rsyslogd(8)

The configuration lives in /etc/rsyslog.conf and the /etc/rsyslog.d/*.conf files it includes.

The configuration files - example
kazulog@sv1:~$ ls -l /etc/rsyslog.conf /etc/rsyslog.d/
-rw-r--r-- 1 root root 1213 Aug 22  2025 /etc/rsyslog.conf

/etc/rsyslog.d/:
total 12
-rw-r--r-- 1 root root  314 May 16  2023 20-ufw.conf
-rw-r--r-- 1 root root  255 Jul 24 01:34 21-cloudinit.conf
-rw-r--r-- 1 root root 1124 Aug 22  2025 50-default.conf

Here is /etc/rsyslog.conf. The four lines used for receiving (17, 18, 21 and 22) are commented out with #.

/etc/rsyslog.conf (before the change)
kazulog@sv1:~$ cat /etc/rsyslog.conf
# /etc/rsyslog.conf configuration file for rsyslog
#
# For more information install rsyslog-doc and see
# /usr/share/doc/rsyslog-doc/html/configuration/index.html
#
# Default logging rules can be found in /etc/rsyslog.d/50-default.conf


#################
#### MODULES ####
#################

module(load="imuxsock") # provides support for local system logging
#module(load="immark")  # provides --MARK-- message capability

# provides UDP syslog reception
#module(load="imudp")
#input(type="imudp" port="514")

# provides TCP syslog reception
#module(load="imtcp")
#input(type="imtcp" port="514")

# provides kernel logging support and enable non-kernel klog messages
module(load="imklog" permitnonkernelfacility="on")

###########################
#### GLOBAL DIRECTIVES ####
###########################

# Filter duplicated messages
$RepeatedMsgReduction on

#
# Set the default permissions for all log files.
#
$FileOwner syslog
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
$PrivDropToUser syslog
$PrivDropToGroup syslog

#
# Where to place spool and state files
#
$WorkDirectory /var/spool/rsyslog

#
# Include all config files in /etc/rsyslog.d/
#
$IncludeConfig /etc/rsyslog.d/*.conf

Enabling reception (/etc/rsyslog.conf)

Edit /etc/rsyslog.conf and remove the # from lines 17–18 (UDP) and 21–22 (TCP).

File to edit
sudo vi /etc/rsyslog.conf
/etc/rsyslog.conf lines 16-22 (after the change)
# provides UDP syslog reception
module(load="imudp")
input(type="imudp" port="514")

# provides TCP syslog reception
module(load="imtcp")
input(type="imtcp" port="514")

Restart after the change. Both UDP and TCP listen, on IPv4 and IPv6.

After the change - example
kazulog@sv1:~$ grep -n 'imudp\|imtcp' /etc/rsyslog.conf
17:module(load="imudp")
18:input(type="imudp" port="514")
21:module(load="imtcp")
22:input(type="imtcp" port="514")
kazulog@sv1:~$ sudo systemctl restart rsyslog
kazulog@sv1:~$ sudo ss -ulnp 'sport = :514'
State               Recv-Q              Send-Q                           Local Address:Port                             Peer Address:Port              Process
UNCONN              0                   0                                      0.0.0.0:514                                   0.0.0.0:*                  users:(("rsyslogd",pid=2939,fd=5))              
UNCONN              0                   0                                         [::]:514                                      [::]:*                  users:(("rsyslogd",pid=2939,fd=6))

Sending logs from a router

Point the IOS XE router R1 at the server. logging trap is the lowest severity to send, and logging origin-id hostname adds the host name to the message.

Commands on R1
logging host 192.168.100.10
logging trap informational
logging origin-id hostname
On R1 - example
R1#show running-config | include logging
no logging console
logging origin-id hostname
logging host 192.168.100.10
R1#send log facility KAZULOG severity 6 mnemonics TESTMSG kazulog-test-message from R1

The logs land in /var/log/syslog. The host name field holds the sender’s IP (192.168.100.1), and R1: appears inside the message.

On the server - example
kazulog@sv1:~$ sudo grep 192.168.100.1 /var/log/syslog | tail -3
2026-09-12T08:30:05.402731+09:00 192.168.100.1 70: R1: *Sep 11 23:30:04.049: %SEC_LOGIN-5-LOGIN_SUCCESS: Login Success [user: kazulog] [Source: 10.100.3.1] [localport: 22] at 23:30:04 UTC Fri Sep 11 2026
2026-09-12T08:30:07.627711+09:00 192.168.100.1 71: R1: *Sep 11 23:30:07.482: %KAZULOG-6-TESTMSG: Message from tty1(user id: kazulog): kazulog-test-message from R1
2026-09-12T08:30:08.627134+09:00 192.168.100.1 72: R1: *Sep 11 23:30:07.514: %SYS-6-LOGOUT: User kazulog has exited tty session 1(10.100.3.1)

Sending from another server (logger)

logger sends a single message. -n is the destination, -P the port, -d UDP, -T TCP and -t the tag.

Sending with logger - example
kazulog@sv2:~$ logger -n 192.168.100.10 -P 514 -d -t kazulog-udp "kazulog-test-message over UDP"
kazulog@sv2:~$ logger -n 192.168.100.10 -P 514 -T -t kazulog-tcp "kazulog-test-message over TCP"
kazulog@sv2:~$ echo "logger rc=$?"
logger rc=0

Both arrive. Here the host name field is sv2.

On the server - example
kazulog@sv1:~$ sudo grep kazulog-test-message /var/log/syslog | tail -3
2026-09-12T08:30:07.627711+09:00 192.168.100.1 71: R1: *Sep 11 23:30:07.482: %KAZULOG-6-TESTMSG: Message from tty1(user id: kazulog): kazulog-test-message from R1
2026-09-12T08:30:12.237901+09:00 sv2 kazulog-udp kazulog-test-message over UDP
2026-09-12T08:30:12.290454+09:00 sv2 kazulog-tcp kazulog-test-message over TCP

Forwarding a whole server’s logs (the sender’s /etc/rsyslog.conf)

Letting the sending server’s rsyslog forward means all of its logs flow to the receiver. The file to edit on the sender is /etc/rsyslog.conf as well; the forwarding settings go at the end.

File to edit (sender sv2)
sudo vi /etc/rsyslog.conf
Appended to /etc/rsyslog.conf (sender sv2)
# 受信サーバー (sv1) へ転送する
action(type="omfwd"
       queue.filename="fwdRule_sv1"
       queue.maxdiskspace="1g"
       queue.saveonshutdown="on"
       queue.type="LinkedList"
       action.resumeRetryCount="-1"
       Target="192.168.100.10" Port="514" Protocol="tcp")
SettingMeaning
Target / Port / ProtocolThe receiving server, its port, and UDP or TCP
queue.filename / queue.maxdiskspaceName and size limit of the queue used when sending fails
queue.saveonshutdownWrite the queue to disk on shutdown
action.resumeRetryCount="-1"Keep retrying while the receiver is unresponsive
The sender's settings - example
kazulog@sv2:~$ tail -8 /etc/rsyslog.conf
# 受信サーバー (sv1) へ転送する
action(type="omfwd"
       queue.filename="fwdRule_sv1"
       queue.maxdiskspace="1g"
       queue.saveonshutdown="on"
       queue.type="LinkedList"
       action.resumeRetryCount="-1"
       Target="192.168.100.10" Port="514" Protocol="tcp")
kazulog@sv2:~$ sudo systemctl restart rsyslog
kazulog@sv2:~$ logger -t kazulog-forward "kazulog-forwarded-message from sv2"

It arrives on the receiver. The host name field, however, is ubuntu, not sv2.

On the receiver - example
kazulog@sv1:~$ sudo grep kazulog-forwarded-message /var/log/syslog
2026-09-12T08:30:33+09:00 ubuntu kazulog-forward: kazulog-forwarded-message from sv2
kazulog@sv1:~$ sudo grep -c "sv2 " /var/log/syslog
2

The reason is that the host name rsyslog uses when forwarding is still ubuntu, from before cloud-init set the host name. The hostname command and journald’s _HOSTNAME both return sv2. To separate by host name, add $LocalHostName sv2 on the sender, or key on the sender’s IP on the receiver.

Separating files per sender (/etc/rsyslog.d/10-remote.conf)

To split received logs by sender, create a new file under /etc/rsyslog.d/.

File to create
sudo vi /etc/rsyslog.d/10-remote.conf
/etc/rsyslog.d/10-remote.conf (new file)
# 送信元ホストごとにファイルを分ける
template(name="RemoteFile" type="string" string="/var/log/remote/%HOSTNAME%/messages.log")
ruleset(name="remote") {
    action(type="omfile" dynaFile="RemoteFile")
}
input(type="imudp" port="514" ruleset="remote")
input(type="imtcp" port="514" ruleset="remote")

The template builds the file name, and only the inputs placed in that ruleset are written there. Using %PROGRAMNAME% (the tag) in the name would split the router’s logs into one file per message, because IOS XE’s message counter (74:) is read as the tag — hence the fixed name here.

The created file - example
kazulog@sv1:~$ ls -l /etc/rsyslog.d/
total 16
-rw-r--r-- 1 root root  316 Sep 12 08:32 10-remote.conf
-rw-r--r-- 1 root root  314 May 16  2023 20-ufw.conf
-rw-r--r-- 1 root root  255 Jul 24 01:34 21-cloudinit.conf
-rw-r--r-- 1 root root 1124 Aug 22  2025 50-default.conf
kazulog@sv1:~$ cat /etc/rsyslog.d/10-remote.conf
# 送信元ホストごとにファイルを分ける
template(name="RemoteFile" type="string" string="/var/log/remote/%HOSTNAME%/messages.log")
ruleset(name="remote") {
    action(type="omfile" dynaFile="RemoteFile")
}
input(type="imudp" port="514" ruleset="remote")
input(type="imtcp" port="514" ruleset="remote")
kazulog@sv1:~$ sudo systemctl restart rsyslog

One directory appears per sender: R1 by IP, sv2’s direct logger messages under sv2, and the rsyslog-forwarded ones under ubuntu.

Per-host files - example
kazulog@sv1:~$ sudo ls -l /var/log/remote/ /var/log/remote/192.168.100.1/ /var/log/remote/sv2/
/var/log/remote/:
total 12
drwx------ 2 syslog syslog 4096 Sep 12 08:32 192.168.100.1
drwx------ 2 syslog syslog 4096 Sep 12 08:32 sv2
drwx------ 2 syslog syslog 4096 Sep 12 08:32 ubuntu

/var/log/remote/192.168.100.1/:
total 4
-rw-r--r-- 1 syslog syslog 509 Sep 12 08:32 messages.log

/var/log/remote/sv2/:
total 4
-rw-r--r-- 1 syslog syslog 158 Sep 12 08:32 messages.log
kazulog@sv1:~$ sudo tail -2 /var/log/remote/192.168.100.1/messages.log
2026-09-12T08:32:34.630302+09:00 192.168.100.1 74: R1: *Sep 11 23:32:34.491: %KAZULOG-6-TESTMSG: Message from tty1(user id: kazulog): kazulog-test-message from R1
2026-09-12T08:32:35.629872+09:00 192.168.100.1 75: R1: *Sep 11 23:32:34.517: %SYS-6-LOGOUT: User kazulog has exited tty session 1(10.100.3.1)
kazulog@sv1:~$ sudo tail -2 /var/log/remote/sv2/messages.log
2026-09-12T08:32:31.511588+09:00 sv2 kazulog-udp kazulog-test-message over UDP
2026-09-12T08:32:31.562850+09:00 sv2 kazulog-tcp kazulog-test-message over TCP

Restricting senders (/etc/rsyslog.conf)

$AllowedSender limits which senders are accepted. It is written per protocol: naming UDP alone has no effect on TCP.

File to edit
sudo vi /etc/rsyslog.conf
Appended at lines 24-25 of /etc/rsyslog.conf
# ログを受け付ける送信元
$AllowedSender UDP, 192.168.100.1/32
$AllowedSender TCP, 192.168.100.1/32
After the change - example
kazulog@sv1:~$ grep -n 'imudp\|imtcp\|AllowedSender' /etc/rsyslog.conf
17:module(load="imudp")
18:input(type="imudp" port="514")
21:module(load="imtcp")
22:input(type="imtcp" port="514")
24:$AllowedSender UDP, 192.168.100.1/32
25:$AllowedSender TCP, 192.168.100.1/32
kazulog@sv1:~$ sudo systemctl restart rsyslog

Logs from sv2, which is not allowed, stop being recorded, while R1’s keep coming. The sending logger still looks successful (it exits 0).

Checking the rejection - example
kazulog@sv1:~$ sudo tail -2 /var/log/remote/sv2/messages.log
2026-09-12T08:32:31.511588+09:00 sv2 kazulog-udp kazulog-test-message over UDP
2026-09-12T08:32:31.562850+09:00 sv2 kazulog-tcp kazulog-test-message over TCP
kazulog@sv1:~$ sudo tail -1 /var/log/remote/192.168.100.1/messages.log
2026-09-12T08:33:13.211924+09:00 192.168.100.1 78: R1: *Sep 11 23:33:12.098: %SYS-6-LOGOUT: User kazulog has exited tty session 1(10.100.3.1)
kazulog@sv1:~$ sudo journalctl -u rsyslog --no-pager -n 6
Sep 12 08:33:11 sv1 rsyslogd[5887]: tcpsrv listener (inputname: 'imtcp') failed to process incoming connection from 192.168.100.20:40852 to 192.168.100.10:514 with error -2063 [v8.2512.0 try https://www.rsyslog.com/e/2063 ]

Final state of the configuration files

This is the state with everything above applied. On the receiver (sv1) only two files were touched: /etc/rsyslog.conf and /etc/rsyslog.d/10-remote.conf.

Configuration files on the receiver sv1
kazulog@sv1:~$ ls -l /etc/rsyslog.conf /etc/rsyslog.d/
-rw-r--r-- 1 root root 1319 Sep 12 08:33 /etc/rsyslog.conf

/etc/rsyslog.d/:
total 16
-rw-r--r-- 1 root root  316 Sep 12 08:32 10-remote.conf
-rw-r--r-- 1 root root  314 May 16  2023 20-ufw.conf
-rw-r--r-- 1 root root  255 Jul 24 01:34 21-cloudinit.conf
-rw-r--r-- 1 root root 1124 Aug 22  2025 50-default.conf
kazulog@sv1:~$ grep -vE '^(#|$)' /etc/rsyslog.conf
module(load="imuxsock") # provides support for local system logging
module(load="imudp")
input(type="imudp" port="514")
module(load="imtcp")
input(type="imtcp" port="514")
$AllowedSender UDP, 192.168.100.1/32
$AllowedSender TCP, 192.168.100.1/32
module(load="imklog" permitnonkernelfacility="on")
$RepeatedMsgReduction on
$FileOwner syslog
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
$PrivDropToUser syslog
$PrivDropToGroup syslog
$WorkDirectory /var/spool/rsyslog
$IncludeConfig /etc/rsyslog.d/*.conf
kazulog@sv1:~$ cat /etc/rsyslog.d/10-remote.conf
# 送信元ホストごとにファイルを分ける
template(name="RemoteFile" type="string" string="/var/log/remote/%HOSTNAME%/messages.log")
ruleset(name="remote") {
    action(type="omfile" dynaFile="RemoteFile")
}
input(type="imudp" port="514" ruleset="remote")
input(type="imtcp" port="514" ruleset="remote")

The service state, the listening sockets, and the directories of collected logs.

State of the receiver sv1
kazulog@sv1:~$ systemctl is-enabled rsyslog; systemctl is-active rsyslog
enabled
active
kazulog@sv1:~$ sudo ss -ulnp 'sport = :514'
State               Recv-Q              Send-Q                           Local Address:Port                             Peer Address:Port              Process
UNCONN              0                   0                                      0.0.0.0:514                                   0.0.0.0:*                  users:(("rsyslogd",pid=5887,fd=7))              
UNCONN              0                   0                                      0.0.0.0:514                                   0.0.0.0:*                  users:(("rsyslogd",pid=5887,fd=5))              
UNCONN              0                   0                                         [::]:514                                      [::]:*                  users:(("rsyslogd",pid=5887,fd=8))              
UNCONN              0                   0                                         [::]:514                                      [::]:*                  users:(("rsyslogd",pid=5887,fd=6))              
kazulog@sv1:~$ sudo ss -tlnp 'sport = :514'
State               Recv-Q              Send-Q                           Local Address:Port                            Peer Address:Port              Process
LISTEN              0                   25                                     0.0.0.0:514                                  0.0.0.0:*                  users:(("rsyslogd",pid=5887,fd=9))               
LISTEN              0                   25                                        [::]:514                                     [::]:*                  users:(("rsyslogd",pid=5887,fd=10))              
kazulog@sv1:~$ sudo ls -l /var/log/remote/ /var/log/remote/192.168.100.1/ /var/log/remote/sv2/
/var/log/remote/:
total 12
drwx------ 2 syslog syslog 4096 Sep 12 08:32 192.168.100.1
drwx------ 2 syslog syslog 4096 Sep 12 08:32 sv2
drwx------ 2 syslog syslog 4096 Sep 12 08:32 ubuntu

/var/log/remote/192.168.100.1/:
total 4
-rw-r--r-- 1 syslog syslog 1017 Sep 12 08:33 messages.log

/var/log/remote/sv2/:
total 4
-rw-r--r-- 1 syslog syslog 158 Sep 12 08:32 messages.log

On the sender (sv2) the only file touched is /etc/rsyslog.conf.

Configuration file on the sender sv2
kazulog@sv2:~$ ls -l /etc/rsyslog.conf
-rw-r--r-- 1 root root 1502 Sep 12 08:30 /etc/rsyslog.conf
kazulog@sv2:~$ grep -vE '^(#|$)' /etc/rsyslog.conf
module(load="imuxsock") # provides support for local system logging
module(load="imklog" permitnonkernelfacility="on")
$RepeatedMsgReduction on
$FileOwner syslog
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
$PrivDropToUser syslog
$PrivDropToGroup syslog
$WorkDirectory /var/spool/rsyslog
$IncludeConfig /etc/rsyslog.d/*.conf
action(type="omfwd"
       queue.filename="fwdRule_sv1"
       queue.maxdiskspace="1g"
       queue.saveonshutdown="on"
       queue.type="LinkedList"
       action.resumeRetryCount="-1"
       Target="192.168.100.10" Port="514" Protocol="tcp")
kazulog@sv2:~$ systemctl is-active rsyslog
active
HostFileChange
sv1 (receiver)/etc/rsyslog.confUncomment lines 17, 18, 21, 22; append two $AllowedSender lines
sv1 (receiver)/etc/rsyslog.d/10-remote.confNew file (splitting files per sender)
sv1 (receiver)/var/log/remote/Created automatically (one directory per sender)
sv2 (sender)/etc/rsyslog.confAppend the omfwd forwarding settings at the end

Turning reception off

Comment the four lines out again, remove the $AllowedSender lines and /etc/rsyslog.d/10-remote.conf, and restart: port 514 closes. Local logging keeps working, and the collected log files stay.

Stopping reception - example
kazulog@sv1:~$ ls -l /etc/rsyslog.d/
total 12
-rw-r--r-- 1 root root  314 May 16  2023 20-ufw.conf
-rw-r--r-- 1 root root  255 Jul 24 01:34 21-cloudinit.conf
-rw-r--r-- 1 root root 1124 Aug 22  2025 50-default.conf
kazulog@sv1:~$ grep -n 'imudp\|imtcp\|AllowedSender' /etc/rsyslog.conf
17:#module(load="imudp")
18:#input(type="imudp" port="514")
21:#module(load="imtcp")
22:#input(type="imtcp" port="514")
kazulog@sv1:~$ sudo systemctl restart rsyslog
kazulog@sv1:~$ sudo ss -ulnp 'sport = :514'; echo "ss rc=$?"
State                  Recv-Q                  Send-Q                                   Local Address:Port                                   Peer Address:Port                 Process
ss rc=0
kazulog@sv1:~$ logger -t kazulog-local "kazulog-local-after-disable"

rsyslog itself ships with Ubuntu as a Priority: important package, so it is not removed here.

Looking inside with a capture

Port 514 was captured on the link between sv1 and the switch. UDP from the router and UDP/TCP from logger appear side by side.

Capture overview - example
$ tshark -r ubuntu-syslog.pcap -n -t ad -Y 'frame.number <= 5'
    1 2026-09-12 08:29:45.569384 192.168.100.1 → 192.168.100.10 Syslog 128 LOCAL7.NOTICE: 69: R1: *Sep 11 23:29:44.473: %SYS-5-CONFIG_I: Configured from console by console
    2 2026-09-12 08:30:05.385447 192.168.100.1 → 192.168.100.10 Syslog 203 LOCAL7.NOTICE: 70: R1: *Sep 11 23:30:04.049: %SEC_LOGIN-5-LOGIN_SUCCESS: Login Success [user: kazulog] [Source: 10.100.3.1] [localport: 22] at 23:30:04 UTC Fri Sep 11 2026
    3 2026-09-12 08:30:07.610694 192.168.100.1 → 192.168.100.10 Syslog 162 LOCAL7.INFO: 71: R1: *Sep 11 23:30:07.482: %KAZULOG-6-TESTMSG: Message from tty1(user id: kazulog): kazulog-test-message from R1
    4 2026-09-12 08:30:08.610247 192.168.100.1 → 192.168.100.10 Syslog 141 LOCAL7.INFO: 72: R1: *Sep 11 23:30:07.514: %SYS-6-LOGOUT: User kazulog has exited tty session 1(10.100.3.1)
    5 2026-09-12 08:30:12.226226 192.168.100.20 → 192.168.100.10 Syslog 191 USER.NOTICE: 1 2026-09-12T08:30:12.237901+09:00 sv2 kazulog-udp - - [timeQuality tzKnown="1" isSynced="1" syncAccuracy="134839"] kazulog-test-message over UDP

The router’s messages have facility LOCAL7 (23) and severity NOTICE (5).

The router's message - example
$ tshark -r ubuntu-syslog.pcap -n -V -O syslog -Y 'frame.number == 1'
Frame 1: Packet, 128 bytes on wire (1024 bits), 128 bytes captured (1024 bits)
Ethernet II, Src: 52:54:00:93:66:9a, Dst: 52:54:00:d1:0a:14
Internet Protocol Version 4, Src: 192.168.100.1, Dst: 192.168.100.10
User Datagram Protocol, Src Port: 53762, Dst Port: 514
Syslog message: LOCAL7.NOTICE: 69: R1: *Sep 11 23:29:44.473: %SYS-5-CONFIG_I: Configured from console by console
    .... ..00 1011 1... = Facility: LOCAL7 - reserved for local use (23)
    .... .... .... .101 = Level: NOTICE - normal but significant condition (5)
    Message: 69: R1: *Sep 11 23:29:44.473: %SYS-5-CONFIG_I: Configured from console by console
        [Expert Info (Note/Protocol): Message conforms to neither RFC 5424 nor RFC 3164; trailing data appended]
            [Message conforms to neither RFC 5424 nor RFC 3164; trailing data appended]
            [Severity level: Note]
            [Group: Protocol]

The logger message is RFC 5424, with version, timestamp, host name and application name as separate fields.

The logger message - example
$ tshark -r ubuntu-syslog.pcap -n -V -O syslog -Y 'frame.number == 5'
Frame 5: Packet, 191 bytes on wire (1528 bits), 191 bytes captured (1528 bits)
Ethernet II, Src: 52:54:00:df:e0:dc, Dst: 52:54:00:d1:0a:14
Internet Protocol Version 4, Src: 192.168.100.20, Dst: 192.168.100.10
User Datagram Protocol, Src Port: 44687, Dst Port: 514
Syslog message: USER.NOTICE: 1 2026-09-12T08:30:12.237901+09:00 sv2 kazulog-udp - - [timeQuality tzKnown="1" isSynced="1" syncAccuracy="134839"] kazulog-test-message over UDP
    .... ..00 0000 1... = Facility: USER - random user-level messages (1)
    .... .... .... .101 = Level: NOTICE - normal but significant condition (5)
    Version: 1
    Timestamp: Sep 12, 2026 08:30:12.237901000 JST
    Hostname: sv2
    App Name: kazulog-udp
    Process ID: -
    Message ID: -
    Structured Data (1 element)
        Element (timeQuality) (3 parameters)
            Element Name: timeQuality
            Parameter (tzKnown)
                Parameter Name: tzKnown
                Parameter Value: 1
            Parameter (isSynced)
                Parameter Name: isSynced
                Parameter Value: 1
            Parameter (syncAccuracy)
                Parameter Name: syncAccuracy
                Parameter Value: 134839
    Message: kazulog-test-message over UDP
Download the pcap of the packet in the tshark output above (No.5 UDP)

tshark reads TCP port 514 as RSH by default. Add -d tcp.port==514,syslog to have it read as syslog.

Inside the TCP messages - example
$ tshark -r ubuntu-syslog.pcap -n -d tcp.port==514,syslog -Y 'tcp.stream == 0 && syslog' -T fields -e frame.number -e ip.src -e syslog.facility -e syslog.msg
9	192.168.100.20	1	kazulog-test-message over TCP\n

logger -T opens a connection per message and closes it.

logger's TCP connection - example
$ tshark -r ubuntu-syslog.pcap -n -t ad -Y 'tcp.stream == 0'
    6 2026-09-12 08:30:12.275358 192.168.100.20 → 192.168.100.10 TCP 74 46098 → 514 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 SACK_PERM TSval=1586745324 TSecr=0 WS=256
    7 2026-09-12 08:30:12.276303 192.168.100.10 → 192.168.100.20 TCP 74 514 → 46098 [SYN, ACK] Seq=0 Ack=1 Win=65160 Len=0 MSS=1460 SACK_PERM TSval=1354922390 TSecr=1586745324 WS=256
    8 2026-09-12 08:30:12.277115 192.168.100.20 → 192.168.100.10 TCP 66 46098 → 514 [ACK] Seq=1 Ack=1 Win=64256 Len=0 TSval=1586745326 TSecr=1354922390
    9 2026-09-12 08:30:12.277270 192.168.100.20 → 192.168.100.10 RSH 216 Client -> Server data
   10 2026-09-12 08:30:12.277373 192.168.100.20 → 192.168.100.10 TCP 66 46098 → 514 [FIN, ACK] Seq=151 Ack=1 Win=64256 Len=0 TSval=1586745327 TSecr=1354922390
   11 2026-09-12 08:30:12.278244 192.168.100.10 → 192.168.100.20 TCP 66 514 → 46098 [ACK] Seq=1 Ack=151 Win=65024 Len=0 TSval=1354922392 TSecr=1586745326
   12 2026-09-12 08:30:12.319384 192.168.100.10 → 192.168.100.20 TCP 66 514 → 46098 [ACK] Seq=1 Ack=152 Win=65024 Len=0 TSval=1354922433 TSecr=1586745327
   13 2026-09-12 08:30:12.587962 192.168.100.10 → 192.168.100.20 TCP 66 514 → 46098 [FIN, ACK] Seq=1 Ack=152 Win=65024 Len=0 TSval=1354922701 TSecr=1586745327
   14 2026-09-12 08:30:12.588628 192.168.100.20 → 192.168.100.10 TCP 66 46098 → 514 [ACK] Seq=152 Ack=2 Win=64256 Len=0 TSval=1586745638 TSecr=1354922701

By contrast, rsyslog’s forwarding (omfwd) sends everything over one connection.

The forwarding connection - example
$ tshark -r ubuntu-syslog.pcap -n -t ad -Y 'frame.number >= 15 && frame.number <= 22'
   15 2026-09-12 08:30:33.716887 192.168.100.20 → 192.168.100.10 TCP 74 36452 → 514 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 SACK_PERM TSval=2878964534 TSecr=0 WS=256
   16 2026-09-12 08:30:33.717884 192.168.100.10 → 192.168.100.20 TCP 74 514 → 36452 [SYN, ACK] Seq=0 Ack=1 Win=65160 Len=0 MSS=1460 SACK_PERM TSval=2658807182 TSecr=2878964534 WS=256
   17 2026-09-12 08:30:33.718545 192.168.100.20 → 192.168.100.10 TCP 66 36452 → 514 [ACK] Seq=1 Ack=1 Win=64256 Len=0 TSval=2878964536 TSecr=2658807182
   18 2026-09-12 08:30:33.718651 192.168.100.20 → 192.168.100.10 RSH 1117 Client -> Server data
   19 2026-09-12 08:30:33.719381 192.168.100.10 → 192.168.100.20 TCP 66 514 → 36452 [ACK] Seq=1 Ack=1052 Win=68096 Len=0 TSval=2658807184 TSecr=2878964536
   20 2026-09-12 08:30:33.719773 192.168.100.20 → 192.168.100.10 RSH 346 Client -> Server data
   21 2026-09-12 08:30:33.720326 192.168.100.10 → 192.168.100.20 TCP 66 514 → 36452 [ACK] Seq=1 Ack=1332 Win=70400 Len=0 TSval=2658807185 TSecr=2878964537
   22 2026-09-12 08:30:33.763520 192.168.100.20 → 192.168.100.10 RSH 145 Client -> Server data

A refused connection completes its handshake and carries data, and the server answers with RST at the end (No.748).

The refused connection - example
$ tshark -r ubuntu-syslog.pcap -n -t ad -Y '(frame.number >= 708 && frame.number <= 713) || frame.number == 748'
  708 2026-09-12 08:33:08.064218 192.168.100.20 → 192.168.100.10 TCP 74 40616 → 514 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 SACK_PERM TSval=4097793459 TSecr=0 WS=256
  709 2026-09-12 08:33:08.064787 192.168.100.10 → 192.168.100.20 TCP 74 514 → 40616 [SYN, ACK] Seq=0 Ack=1 Win=65160 Len=0 MSS=1460 SACK_PERM TSval=2615597037 TSecr=4097793459 WS=256
  710 2026-09-12 08:33:08.065530 192.168.100.20 → 192.168.100.10 TCP 66 40616 → 514 [ACK] Seq=1 Ack=1 Win=64256 Len=0 TSval=4097793461 TSecr=2615597037
  711 2026-09-12 08:33:08.066662 192.168.100.20 → 192.168.100.10 RSH 236 Client -> Server data
  712 2026-09-12 08:33:08.067214 192.168.100.10 → 192.168.100.20 TCP 66 514 → 40616 [ACK] Seq=1 Ack=171 Win=65024 Len=0 TSval=2615597039 TSecr=4097793462
  713 2026-09-12 08:33:08.069621 192.168.100.20 → 192.168.100.10 RSH 1094 Client -> Server data
  748 2026-09-12 08:33:08.370433 192.168.100.10 → 192.168.100.20 TCP 66 514 → 40616 [RST, ACK] Seq=1 Ack=3638 Win=70912 Len=0 TSval=2615597342 TSecr=4097793747
Download the pcap of the packet in the tshark output above (No.748 RST)

Test environment and session logs

Two Ubuntu 26.04 LTS Servers and one IOS XE router on CML. The Ubuntu disks were wiped immediately beforehand, because packages left over from earlier testing would stop the procedure from reproducing.

Test topology
  sv1 (receiver)              sv2 (sender)                R1
  ens3 192.168.100.10/24      ens3 192.168.100.20/24      Gi2 192.168.100.1/24
  rsyslog (UDP/TCP 514)       rsyslog omfwd / logger      IOS XE 17.03.08a
   |                           |                           |
   +--------- LAB-SW ----------+---------------------------+
   ^ captured on this link (port 514)

The full capture:

Capture of the syslog traffic (ubuntu-syslog.pcap)
Stepsv1 (receiver)sv2 (sender)R1
Initial state (just wiped)show / conf / logshow / conf / log—
Checking the configuration filesshow / conf / log——
Enabling receptionshow / conf / log——
Sending from the routershow / conf / log—show
Sending with loggershow / conf / logshow / conf / log—
Forwarding from the sendershow / conf / logshow / conf / log—
Per-host file settingsshow / conf / logshow / conf / logshow
Checking the per-host filesshow / conf / log——
Restricting sendersshow / conf / logshow / conf / logshow
Checking the restrictionshow / conf / log——
Final state of the filesshow / conf / logshow / conf / log—
Turning reception offshow / conf / log——
Analysing the capturetshark——

Reference

rsyslog documentation

RFC 5424 - The Syslog Protocol

Related articles

Ubuntu official pages