Which protocol is used to transport log messages from devices to a central collector, typically using UDP?

Which protocol is used to transport log messages from devices to a central collector, typically using UDP?

• A. SNMP
• B. Syslog
• C. WMI
• D. Web Services

Answer: (B)

Syslog is the protocol designed to transport log messages from devices to a central collector. It’s lightweight and fast, which is why UDP is commonly used as the transport—fire-and-forget messages sent to a log server with minimal overhead. The central collector then stores, indexes, and analyzes these logs. By default, syslog uses UDP port 514, though it can run over TCP or TLS if reliability or security is needed. Other options aren’t intended for standard log transport: SNMP is for management data and can generate traps, WMI is Windows-specific management data, and Web services are for API-based data exchange rather than a dedicated logging channel.

Syslog is the protocol designed to transport log messages from devices to a central collector. It’s lightweight and fast, which is why UDP is commonly used as the transport—fire-and-forget messages sent to a log server with minimal overhead. The central collector then stores, indexes, and analyzes these logs. By default, syslog uses UDP port 514, though it can run over TCP or TLS if reliability or security is needed. Other options aren’t intended for standard log transport: SNMP is for management data and can generate traps, WMI is Windows-specific management data, and Web services are for API-based data exchange rather than a dedicated logging channel.