Skip to main content

Syslog Standards: RFC3164 vs RFC5424

By df

This page provides a clear and concise comparison between the old syslog standard (RFC 3164) and the modern format (RFC 5424). Whether you're working with legacy systems or modern log management tools, understanding the differences in structure, features, and formatting helps ensure better log parsing, monitoring, and compliance across systems.

Comparison Table

Field RFC3164 (Old Format) RFC5424 (New Format)
Example <35>Oct 12 22:14:15 client_machine su: 'su root' failed... <35>1 2013-10-11T22:14:15.003Z client_machine su - - - 'su root' failed...
Timestamp BSD-style (no year, no timezone) ISO-8601 with milliseconds and timezone
Priority Field Numeric value <Facility * 8 + Severity> Same as RFC3164
Hostname client_machine client_machine
Structured Data Not supported Supported (e.g. [exampleSDID@32473 iut="3"])
Max Length ~1024 bytes (typical) Configurable, supports larger payloads

Syslog Priority Matrix: Facility × Severity

Facility-Severity 0
Emergency		 1
Alert		 2
Critical		 3
Error		 4
Warning		 5
Notice		 6
Informational		 7
Debug
0 - Kernel 01234567
1 - User 89101112131415
2 - Mail 1617181920212223
3 - Daemon 2425262728293031
4 - Auth 3233343536373839
5 - Syslog 4041424344454647
6 - LPR 4849505152535455
7 - News 5657585960616263
8 - UUCP 6465666768697071
9 - Cron 7273747576777879
10 - AuthPriv 8081828384858687
11 - FTP 8889909192939495
12 - NTP 96979899100101102103
13 - LogAudit 104105106107108109110111
14 - LogAlert 112113114115116117118119
15 - ClockDaemon120121122123124125126127
16 - Local0 128129130131132133134135
17 - Local1 136137138139140141142143
18 - Local2 144145146147148149150151
19 - Local3 152153154155156157158159
20 - Local4 160161162163164165166167
21 - Local5 168169170171172173174175
22 - Local6 176177178179180181182183
23 - Local7 184185186187188189190191

Recommendation

If your logging infrastructure supports RFC5424, it's generally recommended to adopt it due to its structured format, full timestamps with timezone info, and better compatibility with modern log aggregation tools like Splunk, Graylog, and Elasticsearch.

Reference Links

What is Syslog and how it works

Popular posts from this blog

Syslog Standards: A simple Comparison between RFC3164 & RFC5424

By
Syslog Standards: A simple Comparison between RFC3164 (old format) & RFC5424 (new format) Though syslog standards have been for quite long time, lot of people still doesn't understand the formats in detail. The original standard document is quite lengthy to read and purpose of this article is to explain with examples Some of things you might need to understand The RFC standards can be used in any syslog daemon (syslog-ng, rsyslog etc.) Always try to capture the data in these standards. Especially when you have log aggregation like Splunk or Elastic, these templates are built-in which makes your life simple. Syslog can work with both UDP & TCP  Link to the documents the original BSD format ( RFC3164 ) the “new” format ( RFC5424 ) RFC3164 (the old format) RFC3164 originated from combining multiple implementations (Year 2001) ...
Read more

Create your own Passport Photo using GIMP

By df
This tutorial is for semi-techies who knows a bit of GIMP (image editing).   This tutorial is for UK style passport photo ( 45mm x 35 mm ) which is widely used in UK, Australia, New Zealand, India etc.  This is a quick and easy process and one can create Passport photos at home If you are non-technical, use this link   .  If you want to create United States (USA) Passport photo or Overseas Citizen of India (OCI) photo, please follow this link How to Make your own Passport Photo - Prerequisite GIMP - One of the best image editing tools and its completely Free USB stick or any memory device to store and take to nearby shop A quality Digital camera Local Shops where you can print. Normally it costs (£0.15 or 25 US cents) to print 8 photos Steps (Video Tutorial attached blow of this page) Ask one of your colleague to take a photo  of you with a light background. Further details of how to take a photo  yourself       ...
Read more

VS Code & Portable GIT shell integration in Windows

By df
Visual Studio Code & GIT Portable shell Integration Summary Many of your corporate laptop cannot install programs and it is quite good to have them as portable executables. Here we find a way to have Portable VS Code and Portable GIT and integrate the GIT shell into VS Code Pre-Reqs VS Code (Install version or Portable ) GIT portable Steps Create a directory in your Windows device (eg:  C:\installables\ ) Unpack GIT portable into the above directory (eg it becomes: C:\installables\PortableGit ) Now unpack Visual Studio (VS) Code and run it. The default shell would be windows based Update User or Workspace settings of VS Code (ShortCut is:  Control+Shift+p ) Search for 'Open Workspace Settings (JSON)' and press Enter Update the settings with following setting { "workbench.colorTheme": "Default Dark+", "git.ignoreMissingGitWarning": true, "git.enabled": true, "terminal.integrated.profiles.windo...
Read more