Frame application data
04TLS records protect chunks of bytes. A syslog message may cross record boundaries, and one record may contain several messages. A decimal octet count tells the receiver how many message bytes to consume.
Receiver capability MUST cover2048 octets and SHOULD cover8192. These actual-length bars use the same scale;8192is not a universal maximum.
Source for this drawing: RFC 5425 · Read RFC section 4.3 ↗
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
Count SYSLOG-MSG bytes only; TLS record boundaries and character counts are not message boundaries.
- All syslog messages MUST be sent as TLS application data. SYSLOG-FRAME = MSG-LEN SP SYSLOG-MSG, with a nonzero first decimal digit followed by zero or more digits, then one ASCII space (§4.3). SYSLOG-MSG is the RFC 5424 message, not an arbitrary newline-terminated string.
- MSG-LEN is the octet count of SYSLOG-MSG only: neither the decimal digits nor the separator space are included. A receiver MUST use this length to delimit messages (§4.3.1). The schematic example has24 message bytes; its two-digit prefix plus space makes27 frame bytes.
- Multiple syslog messages can fit one TLS record; one message can span several records (§4.3). Do not infer messages from TLS record or TCP read sizes. The split picture shows plaintext application bytes after TLS decryption, not ciphertext bytes on the network.
- Receivers MUST process messages through 2048 octets and SHOULD process through 8192 (§4.3.1). There is no protocol upper limit per se. A chosen resource limit must not be mislabeled an RFC maximum. A multibyte UTF-8 character counts as multiple octets.
- Length framing is mandatory for this mapping; the delimiter-based legacy alternative in RFC 6587 is not an alternative in RFC 5425. Length delimitation does not establish RFC 5424 grammar validity, certificate trust or durable storage.
Worked message: <34>1 - host app - - - x is24 ASCII octets. Teaching buffer has a local cap, not an RFC maximum.
Read the RFC section ↗