GSEC · Question #250
Which logging capability is provided natively by syslog?
The correct answer is B. Collection. Syslog is a standardized logging protocol whose primary native capability is the collection and forwarding of log messages from devices and applications to a central receiver.
Question
Which logging capability is provided natively by syslog?
Options
- ASecure transit
- BCollection
- CMuIti-platform alerting
- DSecure centralization
How the community answered
(46 responses)- A2% (1)
- B76% (35)
- C7% (3)
- D15% (7)
Why each option
Syslog is a standardized logging protocol whose primary native capability is the collection and forwarding of log messages from devices and applications to a central receiver.
Syslog transmits messages in plaintext by default over UDP port 514; secure transit requires additional configuration such as TLS wrapping via syslog-ng or rsyslog with encryption modules.
Syslog (RFC 5424 and the older RFC 3164) natively defines a protocol for collecting log messages - devices act as originators and send structured log data to a syslog collector or server. Collection is the core built-in function of the protocol; it aggregates messages from diverse sources without requiring additional software beyond a standard syslog daemon.
Multi-platform alerting is not a native syslog capability; it requires integration with a SIEM or monitoring platform such as Splunk or Graylog.
Secure centralization requires encryption and authentication layers on top of syslog; it is not provided natively by the base protocol.
Concept tested: Native capabilities of the syslog protocol
Source: https://datatracker.ietf.org/doc/html/rfc5424
Topics
Community Discussion
No community discussion yet for this question.