Search code examples
syslogrfcsyslog-ng

Syslog RFC5424 Vs RFC6587


I was reading across the net, and I wasn't able to find what are the differences between those protocols when Syslog message is being sent, nor a proper example for how RFC6587 log messages look like. If someone can share some insight regarding those two questions.


Solution

  • The 2 RFCs are for different purposes. RFC 5424 defines a "modern" log format with structural elements, while RFC 6587 can be considered as transport for such a log format over TCP.

    RFC 6587 defines frames around syslog messages, and it also mentions/suggests RFC 5424 as payload:

    https://datatracker.ietf.org/doc/html/rfc6587#section-3.4.1

    SYSLOG-MSG is defined in the syslog protocol [RFC5424] and may also be considered to be the payload in [RFC3164]


    Example for RFC 5424:

    <165>1 2003-10-11T22:14:15.003Z mymachine.example.com evntslog - ID47 [exampleSDID@32473 iut="3" eventSource="Application" eventID="1011"] BOMAn application event log entry...
    

    RFC 6587 is just about framing, so the example would be the same, but with prepending the length of the message: MSG-LEN SP SYSLOG-MSG.