Hacker News Reader

Comment by beefhash | Hacker News Reader

It seems worth noting that the "Syslog message format" was introduced in RFC 5424; the article cites RFC 3164 for message delivery (and should be citing RFC 5424 based on the format).

RFC 5424 defines a more formal and more complete version of the protocol. NetBSD understands and emits it, FreeBSD is still in the process of gaining support for it and OpenBSD seems to be perfectly content sticking to traditional BSD syslog as recorded in RFC 3164.

View on HN

And let's not forget that there are non-standard "syslog" implementations that were being used for decades before RFC3164 happened. Cisco devices and AIX are the first two big ones that come to mind.

It's also worth mentioning that newlines are significant in TCP syslog (for batching log messages) but not in UDP syslog (because of frame size limits)

> It's also worth mentioning that newlines are significant in TCP syslog (for batching log messages) but not in UDP syslog (because of frame size limits)

More because of the D in UDP, I believe. UDP is a packet (datagram) protocol; TCP is a stream protocol.

> And let's not forget that there are non-standard "syslog" implementations that were being used for decades before RFC3164 happened.

totally agree these exist and may vary wildly - many of these are often proprietary forks of the BSD version in some level of (un)maintained state, FWIW

Are there any systems apart from hardware appliances that actually care about the "new" syslog format? I'm running into custom aggregator agents, fluentd, and trivial forwarders everywhere. I don't think I've seen structured syslog or the extended metadata properly used anywhere.

Since we're mentioning some of that newer tech, it might bear bringing up things like http://jsonlines.org for log shipping. If your destination is an ELK stack, this lets you do some neat stuff like adding arbitrary fields in the log shipper and then filter on them in the backend.

Yes, most SIEMs and log management systems support the new format, even if they also push their own proprietary format.

Reply on news.ycombinator.com