Syslog is a client/server protocol standard for forwarding log messages across an IP network. Which transport protocol does Syslog use to transfer log messages in a clear text format?

• A. SMTP
• B. POP
• C. TCP
• D. FTP

Answer: (C)

The transport choice for syslog messages impacts reliability and ordering, which are important for preserving log integrity during forensic analysis. While syslog can run over UDP for simplicity and speed, using a transport that guarantees delivery and in-order reception is often preferred in practice. TCP provides a reliable, connection-oriented channel, ensuring that log messages are not dropped and arrive in the correct sequence, which helps maintain a complete and accurate log trail. Among the given options, TCP is the best fit for transferring syslog in a clear text format because it offers this reliability. The other options are not appropriate for syslog: SMTP is for email, POP is for retrieving email, and FTP is for file transfers, none of which align with the live, continuous forwarding of log messages.