# Syslog message parser > Paste one syslog message, or a TCP frame carrying one, and read every field named in the order its RFC names them: the PRI opened into facility and severity, the RFC 5424 header, the structured data element by element, the message; or the BSD form of RFC 3164 with its TIMESTAMP, HOSTNAME, TAG and CONTENT. Whatever is non-compliant is said in the RFC's own words. Nothing is sent anywhere. - Tool: https://ronutz.com/en/tools/syslog-message-parser - Family: Operations & Fieldcraft --- ## What it does Reads one syslog message as received, or one TCP frame carrying a message, and names every field in the order its RFC names them. Two grammars are tried: the RFC 5424 message (PRI, VERSION, TIMESTAMP, HOSTNAME, APP-NAME, PROCID, MSGID, STRUCTURED-DATA, MSG) and the BSD form RFC 3164 describes (PRI, TIMESTAMP, HOSTNAME, TAG, CONTENT). The PRI is opened into facility and severity through the same tables the [syslog PRI decoder](https://ronutz.com/en/tools/syslog-pri-decoder) uses. Whatever is non-compliant is flagged in the RFC's own words, and the structured data is opened element by element, with the IANA-registered parameters explained. Nothing is sent anywhere. ## What it checks, and where each rule comes from RFC 5424 (March 2009), read 2026-10-05: - The PRI: `<` PRIVAL `>`, PRIVAL = Facility × 8 + Severity, three to five characters; "The only time a value of 0 follows the < is for the Priority value of 0. Otherwise, leading 0s MUST NOT be used" (§6.2.1). Above 191 there is no facility. - VERSION: a non-zero digit followed by up to two digits; "This document uses a VERSION value of 1" (§6.2.2). - TIMESTAMP: "a formalized timestamp derived from RFC 3339"; "The T and Z characters in this syntax MUST be upper case"; "Leap seconds MUST NOT be used"; TIME-SECFRAC is a dot and one to six digits; or the NILVALUE (§6.2.3 and §6). - HOSTNAME 1 to 255, APP-NAME 1 to 48, PROCID 1 to 128, MSGID 1 to 32 printable US-ASCII characters, or the NILVALUE (§6). - STRUCTURED-DATA: `[` SD-ID *(SP SD-PARAM) `]`, elements adjacent; an SD-ID is at most 32 characters; "The same SD-ID MUST NOT exist more than once in a message"; registered names carry no at-sign, private names carry one and an enterprise number; inside a PARAM-VALUE the characters `"`, `\` and `]` are escaped with a backslash (§6.3). The IANA SD-IDs of §7 are timeQuality (tzKnown, isSynced, syncAccuracy), origin (ip, enterpriseId, software, swVersion) and meta (sequenceId, sysUpTime, language); a parameter outside those lists under one of those ids is flagged. - MSG: "If a syslog application encodes MSG in UTF-8, the string MUST start with the Unicode byte order mask (BOM)" (§6.4); non-ASCII text without the BOM is of unknown encoding and is flagged. - Length: "Any transport receiver MUST be able to accept messages of up to and including 480 octets in length. All transport receiver implementations SHOULD be able to accept messages of up to and including 2048 octets in length" (§6.1). RFC 3164 (August 2001), read 2026-10-05: - The packet "MUST be 1024 bytes or less" (§4.1). - TIMESTAMP "Mmm dd hh:mm:ss" in local time, the month one of the twelve English abbreviations, and "If the day of the month is less than 10, then it MUST be represented as a space and then the number" (§4.1.2). - HOSTNAME "will contain the hostname, as it knows itself. If it does not have a hostname, then it will contain its own IP address" (§4.1.2). - TAG "is a string of ABNF alphanumeric characters that MUST NOT exceed 32 characters. Any non-alphanumeric character will terminate the TAG field" (§4.1.3). - A packet whose HEADER cannot be read: the receiver treats everything after the PRI as the message (§4.3). Transports, read 2026-10-05: UDP port 514 (RFC 5426 §3.1); TCP with octet counting, "SYSLOG-FRAME = MSG-LEN SP SYSLOG-MSG", where "It can be assumed that octet-counting framing is used if a syslog frame starts with a digit", or non-transparent framing with a TRAILER that "most often is ASCII LF" (RFC 6587 §3.4.1 and §3.4.2); TLS on TCP port 6514 (RFC 5425 §4.1). A leading count or a trailing newline in the pasted text is read as that framing, and the declared count is checked against the message's actual octets. ## Limits - One message at a time. A file of lines is for the reader's log pipeline; paste the line in question. - The parser reads the message, not the network: it cannot know the transport the message came by, only the framing bytes it carries. - The RFC 3164 form has no year and no zone in its timestamp; the parser says so rather than guessing them. - Input is cut at 8,192 characters. ## Sources - [RFC 5424, The Syslog Protocol, sections 6 to 7](https://www.rfc-editor.org/rfc/rfc5424#section-6) (read 2026-10-05) - [RFC 3164, The BSD syslog Protocol, sections 4.1 to 4.3](https://www.rfc-editor.org/rfc/rfc3164#section-4.1) (read 2026-10-05) - [RFC 5426, Transmission of Syslog Messages over UDP](https://www.rfc-editor.org/rfc/rfc5426#section-3.1) (read 2026-10-05) - [RFC 5425, TLS Transport Mapping for Syslog, section 4.1](https://www.rfc-editor.org/rfc/rfc5425#section-4.1) (read 2026-10-05) - [RFC 6587, Transmission of Syslog Messages over TCP, sections 3.4.1 and 3.4.2](https://www.rfc-editor.org/rfc/rfc6587#section-3.4.1) (read 2026-10-05) ## Standards and references - [RFC 5424, The Syslog Protocol (March 2009), sections 6 to 7](https://www.rfc-editor.org/rfc/rfc5424#section-6) - SYSLOG-MSG = HEADER SP STRUCTURED-DATA [SP MSG]; HEADER = PRI VERSION SP TIMESTAMP SP HOSTNAME SP APP-NAME SP PROCID SP MSGID; the NILVALUE; HOSTNAME 1*255, APP-NAME 1*48, PROCID 1*128, MSGID 1*32 PRINTUSASCII; receivers MUST accept 480 octets and SHOULD accept 2048; VERSION 1; the RFC 3339-derived TIMESTAMP with upper-case T and Z, no leap seconds, up to six fraction digits; SD-ELEMENT, SD-ID at most 32 characters, no duplicate SD-ID, registered names without an at-sign, private names with an enterprise number; the escapes for quote, backslash and bracket; the UTF-8 BOM in MSG; the IANA SD-IDs timeQuality, origin and meta - [RFC 3164, The BSD syslog Protocol (August 2001), sections 4.1 to 4.3](https://www.rfc-editor.org/rfc/rfc3164#section-4.1) - a packet MUST be 1024 bytes or less; TIMESTAMP 'Mmm dd hh:mm:ss' with the twelve month abbreviations and a day under 10 written with a leading space; HOSTNAME the device's name or IP address; TAG alphanumeric and MUST NOT exceed 32 characters, ended by the first non-alphanumeric character; CONTENT the rest; a receiver treats a packet without a valid HEADER as PRI plus message - [RFC 5426, Transmission of Syslog Messages over UDP (March 2009), sections 3.1 and 7](https://www.rfc-editor.org/rfc/rfc5426#section-3.1) - UDP port 514 as the well-known port for syslog - [RFC 5425, TLS Transport Mapping for Syslog (March 2009), section 4.1 Port Assignment](https://www.rfc-editor.org/rfc/rfc5425#section-4.1) - 'The TCP port 6514 has been allocated as the default port for syslog over TLS' - [RFC 6587, Transmission of Syslog Messages over TCP (April 2012), sections 3.4.1 and 3.4.2](https://www.rfc-editor.org/rfc/rfc6587#section-3.4.1) - octet counting: SYSLOG-FRAME = MSG-LEN SP SYSLOG-MSG, 'It can be assumed that octet-counting framing is used if a syslog frame starts with a digit'; non-transparent framing: SYSLOG-FRAME = SYSLOG-MSG TRAILER, the TRAILER most often LF ## Related reading - [Log levels across systems: one scale, many ladders](https://ronutz.com/en/learn/log-levels-across-systems-one-ladder-many-rungs.md): Syslog counts down from 0, Python counts up in tens, Log4j gives FATAL the smallest number and TRACE the largest, Windows puts Critical at 1 and java.util.logging puts SEVERE at 1000. Every system has a ladder, no two ladders agree on direction or spacing, and the same word lands in different places. OpenTelemetry's SeverityNumber is the one scale written to hold them all, and this article walks the ten ladders the mapper knows, where each rung lands, and where the mapping is a judgement rather than a fact. - [Reading a syslog message field by field: what a parser checks, and where each rule comes from](https://ronutz.com/en/learn/reading-a-syslog-message-field-by-field.md): An RFC 5424 message is seven header fields, a structured-data block and a free-text tail, and every one of them has a rule a parser can test: the leading-zero rule of the PRI, the upper-case T and Z of the timestamp, the 48-character APP-NAME, the escapes inside structured data, the byte order mark that announces UTF-8, the 480 and 2048 octet lines, and the two ways a message is framed on TCP. Read from the RFCs themselves, with the parser that applies each rule as you go.