RFC5424 syslog Message Format introduction

# RFC5424 syslog Message Format introduction brief introduction to the [RFC5424](https://tools.ietf.org/html/rfc5424) syslog message format ## outline - definition - format overview - header - PRI - version - timestamp - hostname - app-name - procid - msgid - STRUCTURED-DATA - SD-ELEMENT - SD-ID - SD-PARAM - IANA-registered SD-IDs and PARAM-NAMEs - MSG - syslog messages examples ## definition - An "originator" generates syslog content to be carried in a message. - A "collector" gathers syslog content for further analysis. - A "relay" forwards messages, accepting messages from originators or other relays and sending them to collectors or other relays. ## format overview The syslog message has the following ABNF [[RFC5234]](https://tools.ietf.org/html/rfc5234#section-3.6) definition: ``` SYSLOG-MSG = HEADER SP STRUCTURED-DATA [SP MSG] HEADER = PRI VERSION SP TIMESTAMP SP HOSTNAME SP APP-NAME SP PROCID SP MSGID PRI = "<" PRIVAL ">" PRIVAL = 1*3DIGIT ; range 0 .. 191 VERSION = NONZERO-DIGIT 0*2DIGIT HOSTNAME = NILVALUE / 1*255PRINTUSASCII APP-NAME = NILVALUE / 1*48PRINTUSASCII PROCID = NILVALUE / 1*128PRINTUSASCII MSGID = NILVALUE / 1*32PRINTUSASCII TIMESTAMP = NILVALUE / FULL-DATE "T" FULL-TIME FULL-DATE = DATE-FULLYEAR "-" DATE-MONTH "-" DATE-MDAY DATE-FULLYEAR = 4DIGIT DATE-MONTH = 2DIGIT ; 01-12 DATE-MDAY = 2DIGIT ; 01-28, 01-29, 01-30, 01-31 based on ; month/year FULL-TIME = PARTIAL-TIME TIME-OFFSET PARTIAL-TIME = TIME-HOUR ":" TIME-MINUTE ":" TIME-SECOND [TIME-SECFRAC] TIME-HOUR = 2DIGIT ; 00-23 TIME-MINUTE = 2DIGIT ; 00-59 TIME-SECOND = 2DIGIT ; 00-59 TIME-SECFRAC = "." 1*6DIGIT TIME-OFFSET = "Z" / TIME-NUMOFFSET TIME-NUMOFFSET = ("+" / "-") TIME-HOUR ":" TIME-MINUTE STRUCTURED-DATA = NILVALUE / 1*SD-ELEMENT SD-ELEMENT = "[" SD-ID *(SP SD-PARAM) "]" SD-PARAM = PARAM-NAME "=" %d34 PARAM-VALUE %d34 SD-ID = SD-NAME PARAM-NAME = SD-NAME PARAM-VALUE = UTF-8-STRING ; characters '"', '\' and ; ']' MUST be escaped. SD-NAME = 1*32PRINTUSASCII ; except '=', SP, ']', %d34 (") MSG = MSG-ANY / MSG-UTF8 MSG-ANY = *OCTET ; not starting with BOM MSG-UTF8 = BOM UTF-8-STRING BOM = %xEF.BB.BF UTF-8-STRING = *OCTET ; UTF-8 string as specified ; in RFC 3629 OCTET = %d00-255 SP = %d32 PRINTUSASCII = %d33-126 NONZERO-DIGIT = %d49-57 DIGIT = %d48 / NONZERO-DIGIT NILVALUE = "-" ``` ## HEADER - format: `HEADER = PRI VERSION SP TIMESTAMP SP HOSTNAME SP APP-NAME SP PROCID SP MSGID` - Each character set used in the HEADER must be seven-bit ASCII in an eight-bit field. #### PRI - format ``` PRI = "<" PRIVAL ">" PRIVAL = 1*3DIGIT ; range 0 .. 191 DIGIT = %d48 / NONZERO-DIGIT NONZERO-DIGIT = %d49-57 ``` - `1*3` means "from 1 to 3", and `1*3DIGIT` allows a 1-digit, 2-digit, or 3-digit number. If the number on the left side of `*` is not given, the default value is 0; if the number on the right side of `*` is not given, the default value is infinity. - the content after `;` in a line is a comment - `/` means "or" - `%d49-57` is equivalent to `%d49 / %d50 / ... / %d57`, also equivalent to `"1" / "2" / ... / "9"` - PRIVAL = facility number * 8 + severity number severity number = PRIVAL % 8 facility = PRIVAL / 8 (the possible value of severity number is 0~7) - The facility number specifies the subsystem that produced the message, and the severity number difines the severity of the message. - facility table: ``` Numerical Facility Code 0 kernel messages 1 user-level messages 2 mail system 3 system daemons 4 security/authorization messages 5 messages generated internally by syslogd 6 line printer subsystem 7 network news subsystem 8 UUCP subsystem 9 clock daemon 10 security/authorization messages 11 FTP daemon 12 NTP subsystem 13 log audit 14 log alert 15 clock daemon (note 2) 16 local use 0 (local0) 17 local use 1 (local1) 18 local use 2 (local2) 19 local use 3 (local3) 20 local use 4 (local4) 21 local use 5 (local5) 22 local use 6 (local6) 23 local use 7 (local7) ``` - severity table: ``` Numerical Severity code 0 Emergency: system is unusable 1 Alert: action must be taken immediately 2 Critical: critical conditions 3 Error: error conditions 4 Warning: warning conditions 5 Notice: normal but significant condition 6 Informational: informational messages 7 Debug: debug-level messages ``` #### VERSION - format: ``` VERSION = NONZERO-DIGIT 0*2DIGIT ``` - this field denotes the version of the syslog system #### TIMESTAMP - format: ``` TIMESTAMP = NILVALUE / FULL-DATE "T" FULL-TIME FULL-DATE = DATE-FULLYEAR "-" DATE-MONTH "-" DATE-MDAY DATE-FULLYEAR = 4DIGIT DATE-MONTH = 2DIGIT ; 01-12 DATE-MDAY = 2DIGIT ; 01-28, 01-29, 01-30, 01-31 based on ; month/year FULL-TIME = PARTIAL-TIME TIME-OFFSET PARTIAL-TIME = TIME-HOUR ":" TIME-MINUTE ":" TIME-SECOND [TIME-SECFRAC] TIME-HOUR = 2DIGIT ; 00-23 TIME-MINUTE = 2DIGIT ; 00-59 TIME-SECOND = 2DIGIT ; 00-59 TIME-SECFRAC = "." 1*6DIGIT TIME-OFFSET = "Z" / TIME-NUMOFFSET TIME-NUMOFFSET = ("+" / "-") TIME-HOUR ":" TIME-MINUTE NILVALUE = "-" ``` - `TIME-SECFRAC` enclosed by `[]` such as`[TIME-SECFRAC]`, is equivalent to `*1TIME-SECFRAC`, which means it is an optional element. - elements enclosed by `()` are considered as a single element. (e.g. `("+" / "-") TIME-HOUR ":" TIME-MINUTE` means `"+" or "-" ...`, but not `"+" or "- ..."`) - examples - `2003-10-11T22:14:15.003Z` represents 11 October 2003 at 10:14pm, with 15.003 seconds into the next minute, in UTC. - `2003-08-24T05:14:15+08:00` represents 24 August 2003 at 05:14:15am in NST, which is UTC+8. #### HOSTNAME - format: ``` HOSTNAME = NILVALUE / 1*255PRINTUSASCII PRINTUSASCII = %d33-126 ``` - this field contains the hostname and the domain name of the originator in FQDN (fully qualified domain name) format (specified in [RFC1034](https://tools.ietf.org/html/rfc1034)) - not all syslog applications are able to provide an FQDN. As such, other values may also be present in HOSTNAME. The values could be FQDN, static IP address, hostname, dynamic IP address, or nilvalue (in the order of preference). #### APP-NAME - format: `APP-NAME = NILVALUE / 1*48PRINTUSASCII` - this field identify the device or application that originated the message. - could be used for filtering messages on a relay or collector. #### PROCID - format: `PROCID = NILVALUE / 1*128PRINTUSASCII` - this field is often used to provide the process name or process ID associated with a syslog system. - PROCID can also be used to identify which messages belong to a group of messages. (For example, an SMTP mail transfer agent might put its SMTP transaction ID into PROCID.) #### MSGID - format: `MSGID = NILVALUE / 1*32PRINTUSASCII` - this field identify the type of message. (For example, a firewall might use the MSGID "TCPIN" for incoming TCP traffic and the MSGID "TCPOUT" for outgoing TCP traffic.) ## STRUCTURED-DATA - format: `STRUCTURED-DATA = NILVALUE / 1*SD-ELEMENT` - STRUCTURED-DATA provides a mechanism to express information in a well defined, easily parseable and interpretable data format. - Each character set used in STRUCTURED-DATA must be seven-bit ASCII in an eight-bit field. #### SD-ELEMENT - format: `SD-ELEMENT = "[" SD-ID *(SP SD-PARAM) "]"` - STRUCTURED-DATA can contain zero, one, or multiple SD-ELEMENT. - An SD-ELEMENT consists of a name and name-value pairs. The name is referred to as SD-ID. The name-value pairs are referred to as "SD-PARAM". #### SD-ID - format: ``` SD-ID = SD-NAME SD-NAME = 1*32PRINTUSASCII; except '=', SP, ']', %d34 (") SP = %d32 ``` - identify the type and purpose of the SD-ELEMENT - case-sensitive - there are two formats for SD-ID names: 1. IANA-registered names (discussed below, in [IANA-registered SD-IDs and PARAM-NAMEs](#IANA-registered-SD-IDs-and-PARAM-NAMEs)) 2. names in the format `name@<private enterprise number>` that could be defined by anyone, e.g., `example@32473`. Both the first type and the part preceding the at-sign in the second type SD-ID must not contain an at-sign (@), an equal-sign (=), a closing brace (]), a quote-character ("), whitespace, or control characters (ASCII code 127 and codes 32 or less). - example (discussed below, in [SD-PARAM](#SD-PARAM)) #### SD-PARAM - format: ``` SD-PARAM = PARAM-NAME "=" %d34 PARAM-VALUE %d34 PARAM-NAME = SD-NAME PARAM-VALUE = UTF-8-STRING ; characters '"', '\' and ']' MUST be escaped. ``` - Each SD-PARAM consists of a name, referred to as PARAM-NAME, and a value, referred to as PARAM-VALUE. - PARAM-NAME is case-sensitive. - IANA controls all PARAM-NAMEs, with the exception of those in SD-IDs whose names contain an at-sign. (registered type is discussed below, in [IANA-registered SD-IDs and PARAM-NAMEs](#IANA-registered-SD-IDs-and-PARAM-NAMEs)) - An SD-PARAM MAY be repeated multiple times inside an SD-ELEMENT. - example ``` [exampleSDID@32473 iut="3" eventSource="Application" eventID="1011"][examplePriority@32473 class="high"] ``` - It is a STRUCTURED-DATA with 2 SD-ELEMENTs, each is in brackets `[]`. - In the first element, the SD-ID is `exampleSDID@32473`, and there are three SD-PARAMs with PARAM-NAMEs as `iut`, `eventSource`, `eventID` repectively; and with `PARAM-VALUE` as `3`, `Application`, `1011` respectively. - In the second element, the SD-ID is `examplePriority@32473`, and there is one SD-PARAM with PARAM-NAME as `class`, and and with `PARAM-VALUE` as `high` #### IANA-registered SD-IDs and PARAM-NAMEs - registered SD-IDs and PARAM-NAMEs table (these PARAM-NAMEs should be used with the associated SD-ID) | SD-ID | PARAM-NAME | | -------- | -------- | | timeQuality |tzKnown, isSynced, syncAccuracy| |origin|ip, enterpriseId, software, swVersion| |meta|sequenceId, sysUpTime, language| - timeQuality It is used by the originator to describe its system time when it is not properly synchronized with a reliable external time. - tzKnown - It indicates whether the originator knows its time zone (`1` for yes, `0` for no). - isSynced - It indicates whether the originator is synchronized to a reliable external time source (`1` for yes, `0` for no). - syncAccuracy - It indicates how accurate the originator thinks its time synchronization is. - It is an integer describing the maximum number of microseconds that its clock may be off between synchronization intervals. - It can be used only when the value of isSynced is `1` - example: `[timeQuality tzKnown="1" isSynced="1" syncAccuracy="60000000"]` originator system time is synchronized but could be earlier or later than official time within 1 minute. - origin It may be used to indicate the origin of a syslog message. - ip - It denotes an IP address of originator - It can be used to provide identifying information in addition to what is present in the HOSTNAME field. - If an originator has multiple IP addresses, it may either list one of its IP addresses in the "ip" parameter or include multiple "ip" parameters in a single "origin" structured data element. - example: `[origin ip="192.0.2.1" ip="192.0.2.129"]` - enterpriseId - It must be a 'SMI Network Management Private Enterprise Code', registered and maintained by IANA, whose prefix is iso.org.dod.internet.private.enterprise (1.3.6.1.4.1). - example: The enterprise number of UNIX registered in [PRIVATE ENTERPRISE NUMBERS](https://www.iana.org/assignments/enterprise-numbers/enterprise-numbers) is 4, so the enterpriseId of UNIX would be `1.3.6.1.4.1.4` - software - It identifies the software that generated the message. - If it is used, "enterpriseId" should also be specified. - It parameter is a string no longer than 48 characters. - It is not the same as the APP-NAME header field. It MUST always contain the name of the generating software, whereas APP-NAME can contain anything else, including an operator-configured value. - swVersion - It identifies the version of the software that generated the message. - If it is used, the "software" and "enterpriseId" parameters should be provided, too. - It is a string no longer than 32 characters. - meta It is used to provide meta-information about the message. If the "meta" SD-ID is used, at least one parameter should be specified. - sequenceId - It tracks the originator messages submitting sequence. - It is an integer set to 1 when the syslog function is started and increased with every message up to a maximum value of 2147483647, and set to 1 when it reaches to the maximum value. - sysUpTime - It used to include the SNMP "sysUpTime" parameter in the message, and the value is represented as a decimal integer. - The semantics of the SNMP "sysUpTime" is defined in [RFC3418](https://tools.ietf.org/html/rfc3418), which are "The time (in hundredths of a second) since the network management portion of the system was last re-initialized." - language - It specified the natural language used inside MSG (language identifiers are defined in [BCP 47](https://tools.ietf.org/html/bcp47)). ## MSG - format: ``` MSG = MSG-ANY / MSG-UTF8 MSG-ANY = *OCTET ; not starting with BOM MSG-UTF8 = BOM UTF-8-STRING BOM = %xEF.BB.BF UTF-8-STRING = *OCTET ; UTF-8 string as specified in RFC 3629 OCTET = %d00-255 SP = %d32 ``` - MSG contains a free-form message that provides information about the event. - The character set used in MSG should be UNICODE, encoded using UTF-8. If the syslog application cannot encode the MSG in Unicode, it may use any other encoding. - If a syslog application encodes MSG in UTF-8, the string must start with the Unicode byte order mask (BOM), which for UTF-8 is ABNF `%xEF.BB.BF.` ## syslog messages examples 1. with no STRUCTURED-DATA ``` <34>1 2003-10-11T22:14:15.003Z mymachine.example.com su - ID47 - BOM'su root' failed for lonvick on /dev/pts/8 ``` PRI: `<34>`, Facility: `4`, Severity: `2` VERSION: `1` timestamp:`2003-10-11T22:14:15.003Z` HOSTNAME: `mymachine.example.com`. APP-NAME: `su` PROCID: unknown, displayed as NULVALUE `-` MSGID: `ID47`. The MSG is `'su root' failed for lonvick...`, encoded in UTF-8. There is no STRUCTURED-DATA, displayed as NULVALUE `-` 2. with STRUCTURED-DATA ``` <165>1 2003-10-11T22:14:15.003Z mymachine.example.com evntslog - ID47 [exampleSDID@32473 iut="3" eventSource= "Application" eventID="1011"] BOMAn application event log entry... ``` 3. with no MSG ``` <165>1 2003-10-11T22:14:15.003Z mymachine.example.com evntslog - ID47 [exampleSDID@32473 iut="3" eventSource= "Application" eventID="1011"][examplePriority@32473 class="high"] ```

Syntax	Example	Reference
# Header	Header	基本排版
- Unordered List	Unordered List
1. Ordered List	Ordered List
- [ ] Todo List	Todo List
> Blockquote	Blockquote
Bold font	Bold font
Italics font	Italics font
~~Strikethrough~~	~~Strikethrough~~
19^th^	19^th
H~2~O	H₂O
++Inserted text++	Inserted text
==Marked text==	Marked text
[link text](https:// "title")	Link
![image alt](https:// "title")	Image
`Code`	`Code`	在筆記中貼入程式碼
```javascript var i = 0; ```	`var i = 0;`
:smile:		Emoji list
{%youtube youtube_id %}	Externals
$L^aT_eX$	L^aT_eX
:::info This is a alert area. :::	This is a alert area.