What it's for
Port 514 is the traditional port for Syslog, the standard protocol for forwarding log messages from devices (servers, routers, firewalls, applications) to a centralized logging server. Instead of SSHing into every individual device to check its logs, infrastructure is commonly configured to forward everything to one syslog server (or a modern log-aggregation stack) over this port.
Protocol basics
Classic Syslog runs over UDP, prioritizing low overhead and simplicity over guaranteed delivery — a dropped log message here and there was historically considered an acceptable trade-off for the low resource cost of not maintaining a connection per device. This has a real downside: since UDP doesn't guarantee delivery, log messages can be silently lost under network congestion. For this reason, many modern deployments use Syslog over TCP (often on a different port) or wrap it in TLS entirely when log completeness and confidentiality matter more than raw simplicity.