> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tell.rs/llms.txt
> Use this file to discover all available pages before exploring further.

# Syslog Source

> Receive infrastructure logs over TCP or UDP using standard syslog protocols.

Collect logs from servers, routers, and firewalls using standard syslog. Tell supports both TCP (reliable delivery) and UDP (high-volume, best-effort) with RFC 3164 (BSD) and RFC 5424 (IETF) formats.

## TCP

For reliable log delivery with connection-based framing. Messages are newline-delimited.

```toml theme={null}
[sources.syslog_tcp]
port = 514
```

Syslog has no authentication — any client that can reach the port can send logs. Restrict access at the network level (firewall rules, private subnets).

Port 514 requires root. Use a higher port (e.g., 50514) and redirect with iptables, or run Tell with `CAP_NET_BIND_SERVICE`.

## UDP

For high-volume log ingestion where best-effort delivery is acceptable. Multiple workers share the same port using kernel-level load balancing.

```toml theme={null}
[sources.syslog_udp]
port = 514
```

When the pipeline is busy, packets are dropped rather than queued — consistent with UDP semantics. If you're seeing drops under load, increase the worker count:

```toml theme={null}
[sources.syslog_udp]
port = 514
num_workers = 8
```

## When to use TCP vs UDP

**TCP** when you need every message delivered — audit logs, security events, compliance data.

**UDP** when volume matters more than completeness — application logs, metrics, high-traffic syslog servers.

You can run both at once on different ports to handle both cases.

## Advanced

### TCP config reference

```toml theme={null}
[sources.syslog_tcp]
port = 514
address = "::"              # Bind address
max_message_size = 8192     # Max syslog message (8 KB)
connection_timeout = "30s"  # Idle connection timeout
no_delay = true             # TCP_NODELAY
flush_interval = "100ms"    # Batch flush interval
batch_size = 500            # Messages per batch
max_connections = 10000     # Connection limit
```

### UDP config reference

```toml theme={null}
[sources.syslog_udp]
port = 514
address = "::"              # Bind address
num_workers = 4             # Parallel UDP workers
max_message_size = 8192     # Max syslog message (8 KB)
flush_interval = "50ms"     # Faster flush for UDP bursts
batch_size = 500            # Messages per batch
```