What uses port 514
Network devices, appliances and Unix systems send log lines to a central syslog server (rsyslog, syslog-ng, Graylog, a SIEM) on UDP 514. UDP is fast but drops messages under load and has no encryption; TCP 514 or syslog over TLS on 6514 are more reliable. On TCP, port 514 is historically also rsh, an insecure remote shell that should be disabled.
Should port 514 be open to the internet?
Keep private. Never expose this port to the internet. Keep it on localhost, a private network or behind a VPN or SSH tunnel.
Check what is listening on port 514
sudo ss -ltnp 'sport = :514'
sudo ss -lunp 'sport = :514'sudo lsof -nP -iTCP:514 -sTCP:LISTEN
sudo lsof -nP -iUDP:514Get-NetTCPConnection -LocalPort 514 -State Listen
Get-NetUDPEndpoint -LocalPort 514
netstat -ano | findstr :514No output means nothing is listening. If a service should be, check that it is running and which address it binds to: 127.0.0.1 only accepts local connections, 0.0.0.0 or :: accepts them on every interface.
Fix “address already in use” on port 514
Another process already holds the port. Find it with the commands above, then stop that service properly, or end the process:
sudo kill $(sudo lsof -t -iTCP:514 -sTCP:LISTEN)Stop-Process -Id (Get-NetTCPConnection -LocalPort 514 -State Listen).OwningProcessAllow port 514 from trusted networks only
The examples allow 514 only from 10.0.0.0/8; replace it with your own private network, office IP or VPN range.
sudo ufw allow from 10.0.0.0/8 to any port 514 proto udp
sudo ufw allow from 10.0.0.0/8 to any port 514 proto tcp
# Close it again:
sudo ufw delete allow from 10.0.0.0/8 to any port 514 proto udpsudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" port port="514" protocol="udp" accept'
sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" port port="514" protocol="tcp" accept'
sudo firewall-cmd --reloadNew-NetFirewallRule -DisplayName "Syslog 514/UDP" -Direction Inbound -Protocol UDP -LocalPort 514 -Action Allow -RemoteAddress 10.0.0.0/8
New-NetFirewallRule -DisplayName "Syslog 514/TCP" -Direction Inbound -Protocol TCP -LocalPort 514 -Action Allow -RemoteAddress 10.0.0.0/8On AWS, Google Cloud and Azure, also allow the port in the security group or network firewall rules; host firewalls and cloud firewalls are separate.
Test port 514 from another machine
nc -zv example.com 514Test-NetConnection example.com -Port 514Related ports
- Port 161 (SNMP): used by SNMP for monitoring and managing network devices.
- Port 9200 (Elasticsearch / OpenSearch): the HTTP API port of Elasticsearch and OpenSearch.
More monitoring and logging ports
162 (SNMP traps) , 4317 (OpenTelemetry (OTLP gRPC)) , 4318 (OpenTelemetry (OTLP HTTP)) , 5601 (Kibana) , 9090 (Prometheus) , 9093 (Alertmanager / Kafka controller) , 9100 (Node exporter / printing) . See all ports in the port lookup.
Sources
Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.
Frequently asked questions
What is port 514 used for?
Port 514 is used by syslog for sending log messages to a central server. Network devices, appliances and Unix systems send log lines to a central syslog server (rsyslog, syslog-ng, Graylog, a SIEM) on UDP 514. UDP is fast but drops messages under load and has no encryption; TCP 514 or syslog over TLS on 6514 are more reliable. On TCP, port 514 is historically also rsh, an insecure remote shell that should be disabled.
Is it safe to open port 514?
Never expose this port to the internet. Keep it on localhost, a private network or behind a VPN or SSH tunnel. Allow it only from the networks that need it, as in the firewall examples on this page.
How do I check if port 514 is open?
On the server, list listening sockets with "sudo ss -ltnp 'sport = :514'" on Linux or "sudo lsof -nP -i :514" on macOS. From another machine, run "nc -zv host 514" or, on Windows, "Test-NetConnection host -Port 514". Connection refused means nothing is listening; a timeout means a firewall is dropping the traffic.