Read the priority and header fields
02The header identifies the event source, application and type. Priority combines a facility category with a severity number. The version tells the reader which header format is in use.
A separate timestamp ending 23:59:60Z is outside this RFC’s grammar because leap seconds are disallowed. A valid alternative is 2003-10-11T22:14:15.003Z. The picture stops the invalid form rather than silently repairing it.
Source for this drawing: RFC 5424 · Read RFC section 6.2 ↗
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
A smaller severity number means a more severe event; priority is not a trust score.
- PRI is an angle-bracketed decimal value from 0 through 191. Facility MUST be 0–23 and severity MUST be 0–7; priority = facility × 8 + severity. Leading zeroes MUST NOT be used except for <0>. Facility/severity names in the tables are informational (§6.2.1).
- This publication uses VERSION 1 immediately after PRI, with no separating space. Subsequent header fields are separated by one SP: TIMESTAMP HOSTNAME APP-NAME PROCID MSGID. HEADER MUST use seven-bit ASCII (§§6/6.2).
- TIMESTAMP derives from RFC 3339 but requires uppercase T/Z, disallows leap seconds, and allows at most six fractional digits. An application incapable of obtaining system time MUST use NILVALUE, the hyphen -. Fractional seconds SHOULD be included when accuracy/performance permit (§6.2.3).
- HOSTNAME identifies the original sender, with FQDN preferred; it need not identify the current relay. APP-NAME and MSGID SHOULD identify application and message type. PROCID is implementation-dependent, not necessarily an OS process ID or reliable restart identifier. NILVALUE rules differ by field (§§6.2.4–6.2.7).
- Maximum header token lengths are 255 HOSTNAME, 48 APP-NAME, 128 PROCID and 32 MSGID printable ASCII characters. A hyphen stands for unavailable values; it is not a wildcard. A timestamp does not establish clock accuracy or authenticity.
Worked priority165 is the RFC’s facility20/severity5 example. The message example uses a fictional host. Field blocks are schematic, not proportional packet fields. Optional timeQuality structured data can describe timestamp quality (§7.1).
Read the RFC section ↗