bk99.de entertain the web since 1997

RFC 5424: Syslog: Structured event messages

Summary

RFC 5424 defines a structured syslog message format with priority, time, origin and additional data. Logs only become reliable operational data with consistent context. Transport and format have to be secured separately.

Ideas

  • Facility and severity classify messages.
  • Precise timestamps make correlation easier.
  • Structured data carries machine-readable fields.

Facts

  • RFC 5424 replaces RFC 3164.

Remarks

  • RFC 5424 has the status “Proposed Standard”; current errata and successor documents should also be checked.

Recommendations

  • Synchronise time sources on all systems.
  • Transmit sensitive logs authenticated and encrypted.

References

Read the RFC at the RFC Editor

Search the Web Archive