Visual RFC.
ALL RFCs / RFC 5424
Read the RFC ↗
RFC 5424 / SYSLOG MESSAGE FORMAT

Separate message format from transport

01

Syslog carries event notifications from an originator, through optional relays, to collectors. A collector gathers messages. This RFC defines their format independently of how bytes travel.

DIAGRAMRead RFC section 5 ↗
RFC 5424 · § 5EXAMPLE
4 / 4
Separate message format from transportFixed application roles originator, relay and collector. First state creates a fictional event document. Next sends originator to relay; next forwards relay to collector with same message label, without application ACK. Last separate transport-support view labels MUST TLS and SHOULD UDP, RECOMMENDED deploy TLS. No handshake or storage receipt is invented.OriginatorRelayCollectorMUST support TLSSHOULD support UDPRECOMMENDED: deploy TLS
04
Keep the transport requirement separate.

A distinct requirement view shows MUST support TLS, SHOULD support UDP and RECOMMENDED deploy TLS. Format parsing alone supplies no secure channel or application acknowledgement.

Source for this drawing: RFC 5424 · Read RFC section 5 ↗

Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
New to this? Start hereA quick picture + helpful background

A message needs an address.

Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.

Helpful first, if these ideas are unfamiliar

RFC 6587 Legacy syslog over TCP RFC 3339 Internet timestamps RFC 3629 UTF-8

These pictures are analogies to help you learn. The linked RFC explains the actual rules.

Related RFCs and changes

“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.

KEY POINT

A transport carries the message; it does not redefine its fields.

  • Originators create messages, relays forward them, and collectors gather them. These functions can share one system; deployments can fan out to multiple destinations. Syslog application communication is simplex, not an application request/reply conversation (§4).
  • Transports MUST NOT deliberately alter the syslog message. Temporary transport transformations MUST be reversed at the receiver, so the relay or collector sees an exact copy (§5). This does not guarantee that transmission errors cannot occur.
  • Implementations MUST support the separate RFC 5425 Transport Layer Security (TLS) mapping and SHOULD also support the RFC 5426 UDP mapping. TLS deployment is RECOMMENDED (§5.1). This is stronger than merely suggesting optional TLS support.
  • RFC 5424 is Proposed Standard, March 2009, and obsoletes RFC 3164. It has no formal Updates or UpdatedBy edges. RFC 6587 separately describes Historic plain-TCP framing; it is not the message format taught here.
DETAILS

The drawing is a chosen single-relay path. It is not a TCP/TLS handshake or proof of delivery. No real event logs, sockets or accounts are used.

Read the RFC section ↗

All chapters in RFC 5424

Drawing view

Scroll the drawing to see every part. Playback controls stay above it.

RFC 9700 / CHAPTERS

Chapters

For full details, tables, algorithms, and exceptions, read the original RFC.

RFC status and corrections ↗