Build a frame by counting message octets
02An octet is an eight-bit byte. In octet-counting framing, a decimal message length and one space come before the complete syslog message. That count gives the receiver the message boundary without searching its contents for a special ending character.
Separate standardized-message example uses MSG = UTF-8 BOM plus café. BOM is EF BB BF (3 octets), café is 63 61 66 C3 A9 (5 octets). With the 23-octet ASCII header and separator, the complete message is 31 octets; prefix 31 SP counts all of them, not the visible letters alone.
Source for this drawing: RFC 6587 · Read RFC section 3.4.1 ↗
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
The length counts the message bytes only, excluding its own digits and the separating space.
- The grammar is SYSLOG-FRAME = MSG-LEN SP SYSLOG-MSG. MSG-LEN begins with a nonzero decimal digit followed by zero or more decimal digits. A zero length, leading zero, plus sign or hexadecimal length does not match that grammar.
- SP is one ASCII space (byte 32). MSG-LEN counts the octets of SYSLOG-MSG, not Unicode characters and not the entire frame. A 24-octet message therefore has prefix 24 followed by a space and a total frame length of 27 octets.
- Octet counting allows any character inside the transported message, including a delimiter byte that would confuse newline-based framing. This describes transport transparency; the syslog message format still has its own content rules.
- The historical 1024-octet limit mentioned here belongs to legacy RFC 3164 message format. RFC 6587 says standardized syslog expanded that size; it does not impose 1024 as a universal frame limit or define one new mandatory maximum for every implementation.
Byte lengths are computed from complete fictional messages. UTF-8 means Unicode Transformation Format, 8-bit. The BOM follows RFC 5424 §6.4 message rules; RFC 6587 framing itself adds no encoding indicator. Local helper bounds are not RFC maximums.
Read the RFC section ↗