What is port 514 used for?
Port 514 is syslog, the standard way network devices, Linux servers and appliances send their log messages to a central collector such as a log server or SIEM.
Each message carries a facility, which says what kind of process produced it, and a severity from 0 (emergency) to 7 (debug). Sending over UDP is light, but messages can be lost under load and nothing proves where they came from, so a collector also accepts forged entries. Central logging is still one of the first things an investigation depends on: logs copied off a device as they happen survive even if an attacker wipes the device.
Is port 514 TCP or UDP?
UDP. Syslog's registered port is UDP 514: the device sends each message and does not wait for confirmation. TCP 514 is registered to a different, older service (remote shell), and syslog over TLS has its own port, TCP 6514.
Is syslog on port 514 secure?
No. Messages on UDP 514 are unencrypted, unauthenticated and can be dropped silently. Where logs matter, send them with syslog over TLS on TCP port 6514, which adds encryption, server authentication and reliable delivery.
Port 514 vs port 6514: what is the difference?
UDP 514 is plain syslog: fast, clear text, no delivery guarantee. TCP 6514 is syslog inside TLS: encrypted, authenticated and reliable.
Which CompTIA exams list port 514?
CompTIA lists port 514 by number in the Network+ objectives; the A+ Core 1 port list does not include it.
- Network+ N10-009: objective 1.4 (Networking Concepts), listed as “Syslog, 514”.
The quoted text is how the objectives document lists the port. The exam puts the port in a scenario, such as a firewall rule or a failed connection; it does not only ask for the number.
Check yourself: a practice question
Written by CertSprint for this page. It is not taken from any exam.
A SIEM shows gaps in a busy firewall's logs during traffic peaks. The firewall sends syslog over UDP 514. What is the most likely explanation?
- UDP gives no delivery guarantee, so messages are dropped under load
- Port 514 only works at night
- Syslog severity 7 blocks other messages
- The SIEM licence expired during the peaks
Show the answer
A. UDP gives no delivery guarantee, so messages are dropped under load. UDP syslog is fire and forget. Under load, packets are lost with no retransmission; a TCP or TLS transport fixes that.
Sources: IANA Service Name and Transport Protocol Port Number Registry: port 514; RFC 5424: The Syslog Protocol; RFC 5426: Transmission of Syslog Messages over UDP; RFC 5425: Transport Layer Security (TLS) Transport Mapping for Syslog. The port number and how each exam lists it come from CompTIA's exam objectives, linked from the study plans above. The explanation and the question are CertSprint's own, checked against these sources on 12 November 2026.