Syslog Message Troubleshooting with tcpdump

Quick one-liner: Troubleshoot syslog forwarding with tcpdump — capture, decode, and read syslog messages in plain text on the wire.

🤔 Why This Matters

When you configure a server or firewall to forward logs to a central syslog server, it's not always obvious whether the messages are actually making it across the network. The syslog daemon on the receiving end shows nothing, and you're left guessing: is the sender not sending? Is the firewall blocking? Is the port wrong?

Instead of checking config files back and forth, the fastest way to verify is to capture the traffic directly with tcpdump.

🔧 The Command

On the receiving syslog server, run:

sudo tcpdump -A -i eth0 port 514

Or for TCP syslog (port 601):

sudo tcpdump -A -i eth0 port 601

📊 What You'll See

When syslog messages arrive, you'll see output like:

14:23:01.123456 IP sender.example.com.514 > receiver.example.com.syslog: SYSLOG auth.crit: sshd[1234]: Failed password for root from 10.0.0.1 port 22 ssh2

The -A flag prints the payload in readable text, so you can verify: - The sender hostname/IP - The severity (info, warning, error, critical) - The message content

If you see nothing, the messages aren't reaching your server — check the sender's config, firewall rules, and routing.

🔍 Advanced Filtering

Capture only from a specific sender:

sudo tcpdump -A -i eth0 port 514 and host 10.0.0.5

Capture and save to a file for later analysis:

sudo tcpdump -w /tmp/syslog-capture.pcap -i eth0 port 514

Then open the .pcap in Wireshark.

Count messages per second:

sudo tcpdump -l -i eth0 port 514 | grep -c "SYSLOG"

✅ Quick Reference