# Syslog PRI decoder + encoder > Decode a syslog PRI such as 134 into its facility and severity, or encode them back, all in your browser. - Tool: https://ronutz.com/en/tools/syslog-pri-decoder - Family: Networking --- ## What it does Every syslog message begins with a priority value, the PRI, a small number in angle brackets like `<134>` at the very start of the line. It packs two pieces of information into one number. This tool decodes a PRI into its facility and severity, and encodes a facility and severity back into a PRI and its on-the-wire `` form. It all runs in your browser. ## The PRI formula The PRI combines a facility and a severity with the arithmetic defined in RFC 5424: PRI = Facility * 8 + Severity Facility = PRI / 8 (integer division) Severity = PRI % 8 Because severity occupies only the low three bits, you can read a PRI at a glance once you know the pieces. The valid range is 0 to 191, since the facility runs 0 to 23 and the severity 0 to 7. ## Facility and severity - The **facility** (0 to 23) names the subsystem that produced the message: the kernel, the mail system, the auth system, the syslog daemon itself, and so on, up through the eight `local0` to `local7` slots that network devices and appliances typically use for their own messages. - The **severity** (0 to 7) rates urgency, and it runs in the counterintuitive direction: 0 is the most severe (Emergency) and 7 the least (Debug), with Error at 3 and Informational at 6 in between. ## Worked example - `<134>` decodes to facility 16 (`local0`) and severity 6 (Informational), because `134 = 16 * 8 + 6`. That particular value is a common default for network devices logging routine events. ## Using it Enter a PRI to split it into facility and severity, or pick a facility and severity to get the PRI and the `` string you would see on the wire. RFC 5424 defines the modern syslog format; the older BSD format in RFC 3164 uses the same PRI arithmetic. ## Standards and references - [RFC 5424: The Syslog Protocol](https://datatracker.ietf.org/doc/html/rfc5424) - the PRI formula and the facility and severity tables - [RFC 3164: The BSD syslog Protocol](https://datatracker.ietf.org/doc/html/rfc3164) - the legacy BSD syslog format and PRI - [ManageEngine: Understanding Syslog Facilities](https://www.manageengine.com/products/eventlog/logging-guide/syslog/syslog-facilities.html) - common facility usage and network-device defaults ## Related reading - [How Syslog Travels: UDP, TCP, and TLS](https://ronutz.com/en/learn/syslog-transport.md): Syslog can ride over plain UDP, over TCP, or over TLS, and the choice decides whether messages can be silently lost, reordered, or read in transit. This covers the three transports, the ports involved, and why anything you rely on for audit should not be sent over UDP. - [Syslog Facilities and Severities, Explained](https://ronutz.com/en/learn/syslog-facilities-and-severities.md): Syslog defines 24 facilities and 8 severities. The severities are a clean urgency scale from emergency down to debug; the facilities are a mix of genuinely useful categories and historical Unix leftovers, plus eight local slots that network devices lean on heavily. - [Syslog Message Formats: RFC 3164 vs RFC 5424](https://ronutz.com/en/learn/syslog-message-formats.md): The PRI is the same everywhere, but what follows it is not. Legacy BSD syslog (RFC 3164) has a loose, year-less format, while the modern format (RFC 5424) is precise and structured. Knowing which one you are looking at explains missing timestamps, ambiguous fields, and why parsers disagree. - [Syslog on Network Devices: Which Facility Does What](https://ronutz.com/en/learn/syslog-on-network-devices.md): Firewalls, load balancers, and switches almost all log to the local facilities, but each vendor picks a different default. Knowing that FortiGate defaults to local7, Cisco ASA to local4, and F5 BIG-IP to local0 turns a wall of PRI numbers into a map of which box said what. - [The Syslog PRI: One Number, Two Meanings](https://ronutz.com/en/learn/syslog-pri-facility-severity.md): Every syslog message starts with a PRI, a number in angle brackets that packs a facility and a severity into a single value. The formula is small and the arithmetic is easy once you have seen it: PRI equals facility times eight plus severity.