RFC 5424 / START HERE
Syslog message format, before the details
Syslog: a format for event notifications
Syslog is the protocol name, not an acronym expanded here. An application creates an event message, optional relays forward it, and a collector gathers it. RFC5424 defines the fields inside that message, independently of transport framing.
The idea in one picture
Create an event
Label its fields
Read it with limits
A simplified picture of the idea; the chapters explain the actual mechanisms.
Why it exists
Consistent priorities, source fields and structured metadata make events easier to interpret across systems. This Proposed Standard replaces RFC3164. It requires implementations to support Transport Layer Security (TLS) transport and recommends deploying it; message syntax alone provides no secure channel.
A familiar example
A fictional picnic application records a warning. A collector reads its priority and structured details, but must not treat a claimed hostname or successful parsing as proof of identity, clock accuracy or saved delivery.
Helpful background
You can start here without reading another RFC. If these ideas are unfamiliar, these short introductions may help.
What you’ll learn next
Begin with chapter one, or choose a topic.
- Separate message format from transportSyslog carries event notifications from an originator, through optional relays, to collectors. A collector gathers messages. This RFC defines their format independently of how bytes travel.→
- Read the priority and header fieldsThe header identifies the event source, application and type. Priority combines a facility category with a severity number. The version tells the reader which header format is in use.→
- Build structured data with explicit boundariesStructured data adds named elements and quoted parameter values. Brackets mark each element; an identifier names its meaning. Multiple elements are adjacent, without spaces between them.→
- Distinguish UTF-8 message text from raw octetsMSG is the optional free-form event body. It can contain arbitrary octets, or UTF-8 text identified by the required byte order mark. The body’s encoding differs from the ASCII header and structured parameter rules.→
- Handle length and security limits honestlyA formatted event still has transport size, delivery and trust limits. Receivers have minimum support requirements, while larger messages may be truncated or discarded. A parsed source name does not prove who sent it.→
This introduction explains RFC 5424 (2009). Read the original RFC ↗