Handle length and security limits honestly
05A formatted event still has transport size, delivery and trust limits. Receivers have minimum support requirements, while larger messages may be truncated or discarded. A parsed source name does not prove who sent it.
A parsed HOSTNAME claim reaches a separate trust boundary. It does not become authenticated identity or storage confirmation. The RFC requires TLS support and recommends TLS deployment; it does not turn every header into a signed assertion.
Source for this drawing: RFC 5424 · Read RFC section 6.1 ↗
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
Message format is not delivery confirmation, durable storage or authenticated identity.
- Transport mappings set size limits; RFC5424 gives no universal upper limit. Every receiver MUST accept messages through480octets, SHOULD accept through2048, and MAY accept larger messages (§6.1).
- If a message exceeds supported size, the receiver SHOULD truncate the payload; alternatively it MAY discard it. Truncation MUST occur at the end and can leave invalid UTF-8 or structured data. It MAY discard the result or try to process as much as possible (§6.1).
- Syslog format does not itself authenticate the claimed source or protect confidentiality/integrity. A reliable transport does not confirm collector storage or identify a wrong collector that accepts messages. Secure transport mapping is important (§§8.3–8.9).
- UDP is an alternative only in managed networks explicitly provisioned for syslog traffic; in other environments TLS SHOULD be used (§8.6). Implementations MUST support TLS (§5.1). Optional timeQuality is a sender claim, not cryptographic clock verification.
- Receivers and relays can lose, reorder or encounter duplicate messages; this RFC does not define a universal exactly-once storage guarantee (§8). Operation and trust decisions remain outside a successful grammar parse.
Chosen oversize example: receiver supports480octets, message length700. The480cut is a local configuration example, not a universal maximum or reason to reject481everywhere. No actual logs or service deployment are used.
Read the RFC section ↗