Syslog: the logging agent, from the event to the server
Every mechanism has a step-by-step animation, the configuration explained line by line and the exam notes. Where a parameter changes the outcome, you get a simulator in which you change it yourself.
TL;DR
Syslog is the mechanism a device uses to report what happens to it: each subsystem hands a %FACILITY-SEVERITY-MNEMONIC message to the logging process, which distributes it to the console, the VTY sessions, the buffer in RAM and the servers, each destination with its own severity threshold (0 the most severe, 7 debug). Toward the server, the message goes out over UDP 514 with a PRI code = facility × 8 + severity; TCP and TLS add reliability and authenticity. Without NTP and service timestamps log datetime msec, the log can't be correlated; without source-interface and the right VRF, it doesn't arrive; without a sane threshold on the console, a debug locks up the device. Discriminators filter finely, EEM reacts to messages, SNMP can send them as traps, and a relay normalizes them for the SIEM. Troubleshooting follows the path: host → trap → VRF and route → transport → source → the server's filter.
How to read the notes: red = critical for the exam, green = theory, blue = numbers, yellow = pitfalls, cyan = differences between platforms and standards. In the animations, the configuration lines used in the current step are highlighted automatically; the ← → arrows change the step when the animation is selected.
The analogy, in short
Think of a building's alarm system: the sensors on the floors (the subsystems) send fixed-format notes to the control panel on the ground floor (the logging process), which passes them on to the siren in the lobby, the pager of the guard on shift, the logbook at the front desk and the monitoring company in town — each with its own severity threshold. To the company, the note goes out in an envelope with a code in the corner (PRI), with the time written from a clock set by radio (NTP).
The model holds up to §9. From §10 on (platforms, collectors, SIEM), it breaks; see the full analogy and its limits in §15.