Syslog Source

Collect logs from servers, routers, and firewalls using standard syslog. Tell supports both TCP (reliable delivery) and UDP (high-volume, best-effort) with RFC 3164 (BSD) and RFC 5424 (IETF) formats.

TCP

For reliable log delivery with connection-based framing. Messages are newline-delimited.

[sources.syslog_tcp]
port = 514

Syslog has no authentication — any client that can reach the port can send logs. Restrict access at the network level (firewall rules, private subnets). Port 514 requires root. Use a higher port (e.g., 50514) and redirect with iptables, or run Tell with CAP_NET_BIND_SERVICE.

UDP

For high-volume log ingestion where best-effort delivery is acceptable. Multiple workers share the same port using kernel-level load balancing.

[sources.syslog_udp]
port = 514

When the pipeline is busy, packets are dropped rather than queued — consistent with UDP semantics. If you’re seeing drops under load, increase the worker count:

[sources.syslog_udp]
port = 514
num_workers = 8

When to use TCP vs UDP

TCP when you need every message delivered — audit logs, security events, compliance data. UDP when volume matters more than completeness — application logs, metrics, high-traffic syslog servers. You can run both at once on different ports to handle both cases.

Advanced

TCP config reference

[sources.syslog_tcp]
port = 514
address = "::"              # Bind address
max_message_size = 8192     # Max syslog message (8 KB)
connection_timeout = "30s"  # Idle connection timeout
no_delay = true             # TCP_NODELAY
flush_interval = "100ms"    # Batch flush interval
batch_size = 500            # Messages per batch
max_connections = 10000     # Connection limit

UDP config reference

[sources.syslog_udp]
port = 514
address = "::"              # Bind address
num_workers = 4             # Parallel UDP workers
max_message_size = 8192     # Max syslog message (8 KB)
flush_interval = "50ms"     # Faster flush for UDP bursts
batch_size = 500            # Messages per batch

Getting Started

Tracking

Pipeline

Analytics

Installing

Syslog Source

TCP

UDP

When to use TCP vs UDP

Advanced

TCP config reference

UDP config reference

​TCP

​UDP

​When to use TCP vs UDP

​Advanced

​TCP config reference

​UDP config reference

TCP

UDP

When to use TCP vs UDP

Advanced

TCP config reference

UDP config reference