RFC 5424: Syslog: Structured event messages
Summary
RFC 5424 defines a structured syslog message format with priority, time, origin and additional data. Logs only become reliable operational data with consistent context. Transport and format have to be secured separately.
Ideas
- Facility and severity classify messages.
- Precise timestamps make correlation easier.
- Structured data carries machine-readable fields.
Facts
- RFC 5424 replaces RFC 3164.
Remarks
- RFC 5424 has the status “Proposed Standard”; current errata and successor documents should also be checked.
Recommendations
- Synchronise time sources on all systems.
- Transmit sensitive logs authenticated and encrypted.
References
Read the RFC at the RFC Editor
Links to the original source and the Web Archive open in a new tab.