The Syslog Protocol
obsoletes
- rfc-3164 — The BSD Syslog Protocol
Extracted elements (31)
The 480-octet minimum message size was chosen to fit in a single UDP packet and avoid fragmentation: in a broken network a single packet has higher delivery probability than two fragments. Some UDP implementations historically did not support messages larger than 480 octets.
The layered syslog architecture separates message content from transport so that each protocol feature need only be implemented once rather than once per transport. Prior standardization efforts failed because each required its own packet format and transport, causing subtle long-term compatibility issues.
RFC 5424 retains the BSD syslog PRI syntax and semantics from RFC 3164 to allow legacy implementations to bin messages correctly. The TAG field from RFC 3164 has been split into APP-NAME, PROCID, and MSGID header fields. STRUCTURED-DATA and the richer TIMESTAMP are entirely new additions not present in RFC 3164.
A syslog application MUST use the NILVALUE as TIMESTAMP if it is incapable of obtaining system time.
All implementations of this specification MUST support the TLS-based transport as described in RFC 5425. All implementations SHOULD also support the UDP-based transport (RFC 5426), and deployments are RECOMMENDED to use TLS.
Any syslog transport protocol MUST NOT deliberately alter the syslog message. If the transport performs temporary transformations at the sender, those MUST be reversed at the receiver so that the relay or collector sees an exact copy of the original message.
Any transport receiver MUST be able to accept messages up to and including 480 octets. All transport receiver implementations SHOULD be able to accept messages up to and including 2048 octets. If a receiver truncates, truncation MUST occur at the end of the message.
If a syslog application encodes MSG in UTF-8, the string MUST start with the Unicode BOM (%xEF.BB.BF). The application MUST encode in the 'shortest form' and MUST NOT interpret messages in the 'non-shortest form'.
Inside PARAM-VALUE, the characters '"' (\%d34), '\' (\%d92), and ']' (\%d93) MUST be escaped as '\"', '\\', and '\]' respectively to avoid parsing errors.
Once SD-IDs and PARAM-NAMEs are defined, their syntax and semantics MUST NOT be altered. If a change is desired, a new SD-ID or PARAM-NAME MUST be created and the old one remain unchanged; OPTIONAL PARAM-NAMEs MAY be added to an existing SD-ID.
PARAM-VALUE MUST be encoded in UTF-8. An originator MUST encode in the 'shortest form' and a collector or relay MUST NOT interpret messages in the 'non-shortest form', per UNICODE TR36. The syslog application MUST NOT fail if control characters are present in PARAM-VALUE.
The HEADER character set MUST be seven-bit ASCII in an eight-bit field. HOSTNAME field SHOULD contain an FQDN; if an IPv4 address is used it MUST be in dotted decimal notation; if IPv6, a valid textual representation per RFC 4291 Section 2.2 MUST be used.
The same SD-ID MUST NOT exist more than once in a message. SD-IDs without an at-sign are IANA-reserved and MUST be registered before use; private SD-IDs MUST use the format name@<private-enterprise-number>.
STRUCTURED-DATA provides a well-defined, parseable data format for meta-information or application-specific data. Each SD-ELEMENT consists of an SD-ID and zero or more SD-PARAM name-value pairs enclosed in brackets. STRUCTURED-DATA MUST be NILVALUE when no elements are present.
The 'meta' SD-ID provides message meta-information via 'sequenceId' (integer starting at 1, incrementing per message up to 2147483647 then wrapping to 1), 'sysUpTime' (SNMP sysUpTime in hundredths of a second), and 'language' (BCP 47 language tag for MSG content).
The 'origin' SD-ID allows an originator to provide additional identification: 'ip' (textual IP address, repeatable for multihomed hosts), 'enterpriseId' (IANA SMI private enterprise number), 'software' (max 48 chars), and 'swVersion' (max 32 chars).
The PRI field encodes both Facility (24 values, 0-23) and Severity (8 values, 0-7) in a single numeric value: PRIVAL = Facility * 8 + Severity. Severity 0 is Emergency (system unusable) and Severity 7 is Debug. Facility 0 is kernel messages; facilities 16-23 are local use.
The 'timeQuality' SD-ID allows an originator to describe the trustworthiness of its TIMESTAMP, using the optional parameters 'tzKnown' (1=known, 0=unknown), 'isSynced' (1=synchronized to external source), and 'syncAccuracy' (maximum microseconds offset; only valid when isSynced=1).
RFC 5424 creates the IANA registry 'syslog Structured Data ID Values' for SD-IDs and their associated PARAM-NAMEs. New entries require IETF Review. Initial entries include 'timeQuality', 'origin', and 'meta' SD-IDs with their respective PARAM-NAMEs. Names containing '@' are locally extensible and not IANA-controlled.
RFC 5424 creates the IANA registry 'syslog Version Values' for the VERSION field. New VERSION numbers require Standards Action per RFC 5226 and must be incremented for any change to the HEADER format. VERSION value '1' is the initial registered entry.
Because UDP lacks congestion control, transferring syslog over UDP is problematic for Internet stability. The TLS transport is REQUIRED to implement and RECOMMENDED for general use; UDP MAY only be used in explicitly engineered managed networks with rate limiting or capacity reservations.
Message truncation by size-limited transport receivers can be exploited to hide critical log information. Vital information should be placed as early in the message as possible, and originators should limit user-supplied data size to prevent deliberate overflow.
NUL characters (%d00) and other control characters in MSG or PARAM-VALUE may be used by attackers to hide log data (NUL truncation in C/C++ programs), render messages unreadable (backspace injection), or invalidate cryptographic checksums embedded in messages.
Syslog messages are transmitted in clear text; the protocol provides no confidentiality mechanism. An attacker positioned on the network path can read human-readable message content to gather intelligence for further attacks. Operators should use TLS transport to address this.
The syslog protocol has no mechanism to detect message replay. An attacker may record messages, then replay them (possibly with modified TIMESTAMPs) to falsely indicate normal activity. Cryptographically signing messages is recommended to prevent TIMESTAMP alteration and replay.
UTF-8 non-shortest-form encoding can be exploited to bypass security filters by encoding ASCII characters in multi-byte sequences. RFC 5424 requires 'shortest form' encoding and prohibits interpretation of non-shortest-form sequences throughout the protocol to mitigate this risk.
MSG is optional and is either MSG-ANY (any octets not starting with BOM) or MSG-UTF8 (BOM %xEF.BB.BF followed by a UTF-8 string). The BOM unambiguously signals UTF-8 encoding; its absence means the encoding is unknown.
STRUCTURED-DATA is either NILVALUE or one or more SD-ELEMENTs of the form '[' SD-ID *(SP SD-PARAM) ']', where SD-PARAM = PARAM-NAME '=' %d34 PARAM-VALUE %d34. SD-ELEMENTs are concatenated with no separator between them.
The PRI field encodes facility and severity as '<' PRIVAL '>', where PRIVAL = Facility * 8 + Severity. PRIVAL is 1-3 decimal digits (range 0-191); leading zeros MUST NOT be used except for the value '0' itself. Facility must be 0-23 and Severity 0-7.
The syslog message ABNF structure is: SYSLOG-MSG = HEADER SP STRUCTURED-DATA [SP MSG], where HEADER = PRI VERSION SP TIMESTAMP SP HOSTNAME SP APP-NAME SP PROCID SP MSGID. Each HEADER field is separated by a single SP (%d32). MSG is optional.
TIMESTAMP is an RFC 3339 date-time with restrictions: 'T' and 'Z' MUST be uppercase, leap seconds MUST NOT be used, and TIME-SECFRAC is up to 6 digits. NILVALUE '-' is used when system time is unavailable.