Ask a network engineer how they found the root cause of last month's outage and, surprisingly often, the answer is: "eventually, someone SSH'd into the switch and looked at the logs. It was right there."

Every router, switch, firewall, and access point you own continuously narrates its own condition over syslog — a protocol from 1980s BSD that remains the closest thing infrastructure has to a confessional. The device tells you its fan is dying, its BGP neighbor is flapping, its config was changed at 4:52pm by user admin. The only question is whether anything is listening on UDP 514.

What's actually in there

A sampling of what shows up in device syslog before most dashboards notice anything:

  • Hardware distress: fan RPM warnings, PSU voltage excursions, temperature alarms — often hours or days before failure.
  • Protocol churn: OSPF adjacency resets, BGP session drops, spanning-tree topology changes.
  • Human fingerprints: logins, failed logins, configuration commits. The answer to "what changed right before this broke?" is very frequently a config commit logged in plain sight.
  • Security signal: ACL denies, port-security violations, rogue DHCP servers.

Why teams still don't collect it

The historical objections are real but dated. "It's too noisy" — true, a busy estate produces millions of messages a day, but modern columnar storage ingests and queries that volume trivially; noise is a filtering problem at read time, not a reason to discard at write time. "It's unstructured" — severity, facility, host, and timestamp are structured enough for correlation, and message-pattern extraction handles the rest. "We have SNMP" — polling tells you a counter's value; syslog tells you events between polls, and the two cross-confirm each other.

The correlation payoff

Logs earn their storage the day you line them up against other signals on one timeline. Interface errors climbing on a branch switch is a data point. The same switch logging fan-failure messages for the past six hours is a diagnosis. That join — metrics anomaly meets log evidence from the same device in the same window — is the single most common shape of network root cause, and it's exactly the join we built Ntrospect's log view to make automatic.

Point your gear at a collector this week. Syslog is the cheapest telemetry you will ever deploy: the senders are already configured, already paid for, and already talking.