Port 514 syslog · UDP

What runs on port 514

Syslog over UDP: the classic way to ship logs from routers, firewalls, hypervisors and Unix hosts to a central collector. It is plaintext, unacknowledged and unauthenticated, so anyone on the path can read or forge log lines, and lost packets are simply lost. TCP 514 is historically rsh, though many collectors accept syslog on it too; syslog over TLS is on 6514.

Software that uses it: rsyslog · syslog-ng · Graylog · Splunk · Elastic/Logstash · network gear (sending side)

Should port 514 be open?

Private network or VPN only. Nothing good comes from this port being reachable from the internet. Keep it on an internal network, reach it over a VPN or an SSH tunnel, and firewall it from everything that does not need it.

• Use TCP or TLS (6514) for anything you need to be complete; UDP for devices that cannot do better, on a management network.
• Check that the collector listens: ss -ulnp | grep 514.

Check port 514

# on the host: is anything listening, and which process?
ss -lunp 'sport = :514'
sudo lsof -i :514

# from another machine: is it reachable?
nc -zuv host 514
sudo nmap -sU -p 514 host

A port that answers from the internet when it should not is the finding; nmap from a machine outside your network (or a VPS) is the honest test, because scans from inside the LAN pass the firewall you are trying to verify.

Allow or block port 514

# ufw (Ubuntu/Debian)
sudo ufw allow from 10.0.0.0/8 to any port 514 proto udp
sudo ufw deny 514/udp

# nftables
nft add rule inet filter input ip saddr 10.0.0.0/8 udp dport 514 accept
nft add rule inet filter input udp dport 514 drop

# iptables (legacy)
iptables -A INPUT -p udp --dport 514 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p udp --dport 514 -j DROP

# firewalld
sudo firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=10.0.0.0/8 port port=514 protocol=udp accept'

Replace 10.0.0.0/8 with the networks that need access. Allowing by source address is the rule that matters; "allow 514" with no source is just "open".

Related ports

• 6514 syslog over TLS
• 601 syslog (TCP) — IANA-registered reliable syslog
• 161 SNMP — Network monitoring

Part of the port number reference. Ports are 16-bit numbers; see also the subnet calculator and the packet decoder, which shows ports inside TCP and UDP headers.

Questions