Search code examples
linuxsyslog

understanding syslog logs format

Im geting syslogs from multiple servers, and Im having trouble to understand some syslog logs, here is one example

<189>12593340: 16596512: Jul  6 20:31:09: %PARSER-5-CFGLOG_LOGGEDCMD: User:someuser  logged command:no 1480

the first number inside <> is the priority, but the two numbers after that: "12593340" and "16596512" I dont know what their are.

Does anyone knows what are those numbers? how many formats the syslog logs has?

Solution

  • This is specified in the Syslog RFC:

    https://www.rfc-editor.org/rfc/rfc5424#section-6.2.1

    Some years ago I wrote a Shell script to calculate the numbers:

    https://gist.github.com/ceving/b32d4986f43d66f252ef