Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm considering using a service from (other similar services are loggly and splunk), where you configure your syslog to echo events to it over udp. It involves adding this entry to /etc/rsyslog.conf

*.*  (where 12345 is a port unique to my account)

So my question is, is this secure? Couldn't someone sniff the traffic and watch the log output from my server?

share|improve this question
up vote 1 down vote accepted

No, it is not secure. Not only can they watch the log output if they can sniff the traffic, but they can spoof log messages coming from your systems too.

You should consider using a modern syslog implementation with RELP. I believe RELP is still not secure enough for what you are asking (though I might be wrong) but it is a lot better than the standard lightweight UDP syslog protocol. Also it is reliable (the "R" in "RELP") so it is a lot better for transmission over WANs.

share|improve this answer

Nothing is 100% "secure". You need to decide what is worth protecting against and what is an imaginary problem in your specific environment. For example, "hackers" rarely sit in the middle of the wired network sniffing traffic, only ISPs and governments do so.

If you want to protect your traffic against your government's and ISP's surveillance, then yes, UDP transport is insecure. If you don't care about those, then UDP is good enough.

Re spoofing messages - the same story - decide if it bothers you and then act accordingly.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .