ronutz

Syslog message parser

Paste one syslog message, or a TCP frame carrying one, and read every field named in the order its RFC names them: the PRI opened into facility and severity, the RFC 5424 header, the structured data element by element, the message; or the BSD form of RFC 3164 with its TIMESTAMP, HOSTNAME, TAG and CONTENT. Whatever is non-compliant is said in the RFC's own words. Nothing is sent anywhere.

Operations & Fieldcraft
Documentation
Try

RFC 5424 syslog message. 175 octets (173 characters). Nothing non-compliant found.

The PRI, opened

PRI<165> = 20 × 8 + 5Facility20 local4 local use 4Severity5 notice Notice Normal but significant condition.

The fields, in the RFC's order

fieldvaluereading
PRI<165>Facility × 8 + Severity in angle brackets; three to five characters (RFC 5424 §6.2.1).
VERSION1The protocol version; this RFC's is 1 (§6.2.2).
TIMESTAMP2003-10-11T22:14:15.003ZRFC 3339 form: date, T, time, optional fraction of up to six digits, Z or an offset; or the NILVALUE (§6.2.3). date 2003-10-11, time 22:14:15.003, offset Z (UTC)
HOSTNAMEmymachine.example.comThe originator: FQDN, static IP address, hostname or dynamic IP address, in that order of preference; 1 to 255 printable US-ASCII characters (§6.2.4).
APP-NAMEevntslogThe device or application that originated the message; 1 to 48 characters (§6.2.5).
PROCIDNILVALUEA change in its value indicates a discontinuity in reporting (often the process ID); 1 to 128 characters (§6.2.6).
MSGIDID47The type of message; 1 to 32 characters (§6.2.7).
STRUCTURED-DATA[exampleSDID@32473 iut="3" eventSource="Application" eventID="1011"]Zero or more elements, each [SD-ID param="value" ...]; the NILVALUE when none (§6.3).
MSGAn application event log entry...Free-form text; UTF-8 when it starts with the BOM, otherwise of unknown encoding (§6.4). UTF-8, declared by the BOM.

Structured data: 1 element

  • exampleSDID@32473 private (enterprise number)
    iut"3"eventSource"Application"eventID"1011"

Findings, limits and transports

  • Length: 175 octets. Every receiver must accept 480; every receiver should accept 2048 (RFC 5424 §6.1).
  • Transports: UDP port 514 (RFC 5426); TCP with octet counting or a trailer (RFC 6587); TLS on TCP port 6514 (RFC 5425).
API endpointGEThttps://ronutz.com/api/v1/syslog-message-parserDocumented, not served. Opens the specification.

Références