Syslog (short for “system logging protocol”) is a standard way for devices, apps, and systems to send little messages (“logs”) to a logging server. These logs can include everything from app errors and software updates to warnings about suspicious behavior.

For example, Your router, firewall, servers, and even printers are all talking to one syslog server. Each sends messages about what’s happening, and your syslog server collects it all. Now you see the whole picture without running around and asking each gadget for a status update.

Why do threat actors hate syslog?

Because syslog ruins three of their favorite things:

1. Stealth. Centralized, append-only logging means their actions get copied off the compromised host; even if they wipe local logs, the trail still exists on the syslog server.
2. Control of the narrative. Syslog timestamps, source hosts, and severity levels give defenders a coherent timeline that’s hard to fake without also compromising the logging pipeline itself.
3. Alert evasion. Modern SOC tooling (SIEM/XDR/ITDR) hangs a ton of detections and correlation rules off syslog events; if logging is healthy, noisy attacker behavior (auth failures, service crashes, config changes, etc.) is much more likely to light something up.