The encyclopedia · Software & IT · Technical decision · 1980–2009
Syslog won logging by sending plain text over UDP and never waiting for an answer
Born in 1980s BSD/sendmail, syslog became computing's default logging standard because a UDP message costs nothing and can never slow or crash the sender.
UC Berkeley (BSD Unix)
the move
In the 1980s Eric Allman built a logging facility while working on sendmail at UC Berkeley; the BSD syslog design spread to every Unix and then into routers, switches and network gear, because it answered one question any operator has: what happened, and where? RFC 3164 (2001) described it as a protocol "used for the transmission of event notification messages across networks for many years" — a de facto standard before it was ever a formal one.
The design choice that made adoption painless: a syslog client sends a plain-text line to a collector over UDP port 514 with no connection and no acknowledgment — pure fire-and-forget. The application never blocks and never crashes because logging is slow or the collector is down; worst case, a packet disappears. RFC 5424 (2009) later standardized the format on the IETF standards track, obsoleting RFC 3164 while keeping the same lightweight model.
Because the barrier was near zero, every operating system and network device shipped a client; centralized log servers became the norm, and syslog became the lingua franca that SIEM and log-management products still collect today, with TCP and TLS added later for reliability and security where UDP's drops mattered.
why it works
- Fire-and-forget UDP means a logging call can never slow or crash the app.
- Plain text needs no parser or schema, so any program could join in minutes.
- BSD shipped it in every Unix, so it spread by default rather than by mandate.
- Later RFCs formalized what was already everywhere.
what transfers
Make the telemetry channel cost nothing to use: if logging can block the sender, nobody will log; fire-and-forget got adopted everywhere.
what came after
RFC 3164 (2001) documented the informal protocol; RFC 5424 (2009) made it an IETF standard and RFC 5426 mapped it to UDP. Every major operating system, router and firewall still emits syslog, and log-management platforms collect it; structured logging and TCP/TLS variants were layered on later for reliability and encryption.
references
spotted an error? The archive wants to know.