diff --git a/src/apps.js b/src/apps.js
index 64e96769f..d5af51124 100644
--- a/src/apps.js
+++ b/src/apps.js
@@ -218,7 +218,6 @@ function validatePortBindings(portBindings, manifest) {
         993, /* imaps */
         995, /* pop3s */
         2003, /* graphite (lo) */
-        2514, /* cloudron-syslog (lo) */
         constants.PORT, /* app server (lo) */
         constants.AUTHWALL_PORT, /* protected sites */
         constants.INTERNAL_SMTP_PORT, /* internal smtp port (lo) */
diff --git a/src/docker.js b/src/docker.js
index 790723bb0..f5a631742 100644
--- a/src/docker.js
+++ b/src/docker.js
@@ -345,7 +345,7 @@ async function createSubcontainer(app, name, cmd, options) {
                 Type: 'syslog',
                 Config: {
                     'tag': app.id,
-                    'syslog-address': 'udp://127.0.0.1:2514', // see apps.js:validatePortBindings()
+                    'syslog-address': `unix://${paths.SYSLOG_SOCKET_FILE}`,
                     'syslog-format': 'rfc5424'
                 }
             },
diff --git a/src/dockerproxy.js b/src/dockerproxy.js
index eec0eff3a..35cc7be68 100644
--- a/src/dockerproxy.js
+++ b/src/dockerproxy.js
@@ -67,7 +67,7 @@ async function containersCreate(req, res, next) {
     safe.set(req.body, 'HostConfig.NetworkMode', 'cloudron'); // overwrite the network the container lives in
     safe.set(req.body, 'NetworkingConfig', {}); // drop any custom network configs
     safe.set(req.body, 'Labels',  Object.assign({}, safe.query(req.body, 'Labels'), { appId: req.app.id, isCloudronManaged: String(false) }));    // overwrite the app id to track containers of an app
-    safe.set(req.body, 'HostConfig.LogConfig', { Type: 'syslog', Config: { 'tag': req.app.id, 'syslog-address': 'udp://127.0.0.1:2514', 'syslog-format': 'rfc5424' }});
+    safe.set(req.body, 'HostConfig.LogConfig', { Type: 'syslog', Config: { 'tag': req.app.id, 'syslog-address': `unix://${paths.SYSLOG_SOCKET_FILE}`, 'syslog-format': 'rfc5424' }});
 
     const appDataDir = path.join(paths.APPS_DATA_DIR, req.app.id, 'data');
 
diff --git a/src/infra_version.js b/src/infra_version.js
index f97c919c8..0f89b852b 100644
--- a/src/infra_version.js
+++ b/src/infra_version.js
@@ -6,7 +6,7 @@
 
 exports = module.exports = {
     // a version change recreates all containers with latest docker config
-    'version': '49.5.0',
+    'version': '49.6.0',
 
     // a major version bump in the db containers will trigger the restore logic that uses the db dumps
     // docker inspect --format='{{index .RepoDigests 0}}' $IMAGE to get the sha256
diff --git a/src/mailserver.js b/src/mailserver.js
index fc179993e..e4a0c9173 100644
--- a/src/mailserver.js
+++ b/src/mailserver.js
@@ -179,7 +179,7 @@ async function configureMail(mailFqdn, mailDomain, serviceConfig) {
                 --net cloudron \
                 --net-alias mail \
                 --log-driver syslog \
-                --log-opt syslog-address=udp://127.0.0.1:2514 \
+                --log-opt syslog-address=unix://${paths.SYSLOG_SOCKET_FILE} \
                 --log-opt syslog-format=rfc5424 \
                 --log-opt tag=mail \
                 -m ${memory} \
diff --git a/src/paths.js b/src/paths.js
index 427f6d344..b710b7d07 100644
--- a/src/paths.js
+++ b/src/paths.js
@@ -68,5 +68,7 @@ exports = module.exports = {
     BACKUP_LOG_FILE: path.join(baseDir(), 'platformdata/logs/backup/app.log'),
     UPDATER_LOG_FILE: path.join(baseDir(), 'platformdata/logs/updater/app.log'),
 
+    SYSLOG_SOCKET_FILE: path.join(baseDir(), 'platformdata/logs/syslog.sock'),
+
     OIDC_STORE_DIR: path.join(baseDir(), 'platformdata/oidc'),
 };
diff --git a/src/services.js b/src/services.js
index 19ff43d0a..17bd4b049 100644
--- a/src/services.js
+++ b/src/services.js
@@ -941,7 +941,7 @@ async function startTurn(existingInfra) {
                 --hostname turn \
                 --net host \
                 --log-driver syslog \
-                --log-opt syslog-address=udp://127.0.0.1:2514 \
+                --log-opt syslog-address=unix://${paths.SYSLOG_SOCKET_FILE} \
                 --log-opt syslog-format=rfc5424 \
                 --log-opt tag=turn \
                 -m ${memory} \
@@ -1149,7 +1149,7 @@ async function startMysql(existingInfra) {
                 --net cloudron \
                 --net-alias mysql \
                 --log-driver syslog \
-                --log-opt syslog-address=udp://127.0.0.1:2514 \
+                --log-opt syslog-address=unix://${paths.SYSLOG_SOCKET_FILE} \
                 --log-opt syslog-format=rfc5424 \
                 --log-opt tag=mysql \
                 --dns 172.18.0.1 \
@@ -1370,7 +1370,7 @@ async function startPostgresql(existingInfra) {
                 --net cloudron \
                 --net-alias postgresql \
                 --log-driver syslog \
-                --log-opt syslog-address=udp://127.0.0.1:2514 \
+                --log-opt syslog-address=unix://${paths.SYSLOG_SOCKET_FILE} \
                 --log-opt syslog-format=rfc5424 \
                 --log-opt tag=postgresql \
                 --dns 172.18.0.1 \
@@ -1517,7 +1517,7 @@ async function startMongodb(existingInfra) {
                 --net cloudron \
                 --net-alias mongodb \
                 --log-driver syslog \
-                --log-opt syslog-address=udp://127.0.0.1:2514 \
+                --log-opt syslog-address=unix://${paths.SYSLOG_SOCKET_FILE} \
                 --log-opt syslog-format=rfc5424 \
                 --log-opt tag=mongodb \
                 --dns 172.18.0.1 \
@@ -1668,7 +1668,7 @@ async function startGraphite(existingInfra) {
         --net cloudron \
         --net-alias graphite \
         --log-driver syslog \
-        --log-opt syslog-address=udp://127.0.0.1:2514 \
+        --log-opt syslog-address=unix://${paths.SYSLOG_SOCKET_FILE} \
         --log-opt syslog-format=rfc5424 \
         --log-opt tag=graphite \
         -m ${memory} \
@@ -1789,7 +1789,7 @@ async function setupRedis(app, options) {
                 --net cloudron \
                 --net-alias ${redisName} \
                 --log-driver syslog \
-                --log-opt syslog-address=udp://127.0.0.1:2514 \
+                --log-opt syslog-address=unix://${paths.SYSLOG_SOCKET_FILE} \
                 --log-opt syslog-format=rfc5424 \
                 --log-opt tag=${redisName} \
                 -m ${memory} \
diff --git a/src/sftp.js b/src/sftp.js
index d15ab1c79..1da94066b 100644
--- a/src/sftp.js
+++ b/src/sftp.js
@@ -108,7 +108,7 @@ async function start(existingInfra) {
                 --net cloudron \
                 --net-alias sftp \
                 --log-driver syslog \
-                --log-opt syslog-address=udp://127.0.0.1:2514 \
+                --log-opt syslog-address=unix://${paths.SYSLOG_SOCKET_FILE} \
                 --log-opt syslog-format=rfc5424 \
                 --log-opt tag=sftp \
                 -m ${memory} \
diff --git a/syslog/server.js b/syslog/server.js
index e2f1e8a18..41c411409 100644
--- a/syslog/server.js
+++ b/syslog/server.js
@@ -9,8 +9,8 @@ const LOG_FILENAME = 'app.log';
 
 const assert = require('assert'),
     debug = require('debug')('syslog:server'),
-    dgram = require('dgram'),
     fs = require('fs'),
+    net = require('net'),
     path = require('path'),
     parser = require('nsyslog-parser'),
     util = require('util');
@@ -19,42 +19,48 @@ let server = null;
 
 async function start(options) {
     assert.strictEqual(typeof options, 'object');
-    assert.strictEqual(typeof options.port, 'number');
     assert.strictEqual(typeof options.logFolder, 'string');
 
     debug('==========================================');
     debug('          Cloudron Syslog Daemon          ');
     debug('==========================================');
 
-    server = dgram.createSocket('udp4');
+    server = net.createServer();
 
     server.on('error', function (error) {
-        console.error(`socket error: ${error}`);
+        console.error(`server error: ${error}`);
     });
 
-    server.on('message', function (msg /*, rinfo */) {
-        const info = parser(msg.toString());
+    server.on('connection', function (socket) {
+        socket.on('data', function (msg) {
+            const info = parser(msg.toString());
 
-        if (!info || !info.appName) return debug('Ignore unknown app log:', msg.toString());
+            if (!info || !info.appName) return debug('Ignore unknown app log:', msg.toString());
 
-        // remove line breaks to avoid holes in the log file
-        // we do not ignore empty log lines, to allow gaps for potential ease of readability
-        const message = info.message.replace(/\n/g, '');
+            // remove line breaks to avoid holes in the log file
+            // we do not ignore empty log lines, to allow gaps for potential ease of readability
+            const message = info.message.replace(/\n/g, '');
 
-        const filePath = path.join(options.logFolder, info.appName);
-        const fileName = path.join(filePath, LOG_FILENAME);
+            const filePath = path.join(options.logFolder, info.appName);
+            const fileName = path.join(filePath, LOG_FILENAME);
 
-        try {
-            fs.mkdirSync(filePath, { recursive: true });
-            fs.appendFileSync(fileName, info.ts.toISOString() + ' ' + message + '\n');
-        } catch (error) {
-            console.error(error);
-        }
+            try {
+                fs.mkdirSync(filePath, { recursive: true });
+                fs.appendFileSync(fileName, info.ts.toISOString() + ' ' + message + '\n');
+            } catch (error) {
+                console.error(error);
+            }
+        });
+
+        socket.on('error', function (error) {
+            console.error(`socket error: ${error}`);
+        });
     });
 
-    await util.promisify(server.bind.bind(server))(options.port); // intentional double "bind"
+    await fs.promises.rm('/home/yellowtent/platformdata/logs/syslog.sock', { force: true });
+    await util.promisify(server.listen.bind(server))('/home/yellowtent/platformdata/logs/syslog.sock');
 
-    debug(`Listening on port ${options.port}`);
+    debug('Listening on syslog.sock');
 }
 
 async function stop() {
diff --git a/syslog/service.js b/syslog/service.js
index e7c9ab38d..20c14379b 100755
--- a/syslog/service.js
+++ b/syslog/service.js
@@ -5,8 +5,7 @@
 const server = require('./server.js');
 
 const options = {
-    logFolder: process.argv[2] || '/home/yellowtent/platformdata/logs',
-    port: 2514
+    logFolder: '/home/yellowtent/platformdata/logs',
 };
 
 async function main() {