Syslog
Standard protocol for system logging:
Message Format
| Field | Description | Example Value |
|---|---|---|
PRI | Priority value = Facility * 8 + Severity, enclosed in angle brackets | <34> |
TIMESTAMP | Date and time in "Mmm dd hh:mm:ss" format | Oct 22 12:34:56 |
HOSTNAME | Hostname or IP address of the sender | <hostname> |
TAG | Application name and optional PID | appname[1234] |
MESSAGE | Free-form message content | This is a log message. |
| Field | Description | Example Value |
|---|---|---|
PRI | Priority value = Facility * 8 + Severity, enclosed in angle brackets | <34> |
VERSION | Syslog protocol version (always 1 for RFC 5424) | 1 |
TIMESTAMP | ISO 8601 timestamp with optional timezone | 2025-01-03T14:07:15.003Z |
HOSTNAME | FQDN or IP address of the sender | host.example.com |
APP-NAME | Application name | appname |
PROCID | Process ID | 1234 |
MSGID | Identifier for the type of message. Surfaced as unmapped, not msgid | ID47 |
STRUCTURED-DATA | Optional structured key-value pairs | [exampleSDID@32473 iut="3"] |
MESSAGE | Free-form message content | This is a structured log message. |
Facility Values
The RFC names each facility as prose. DataStream emits a short label instead, in log.syslog.facility.name—filter on the emitted name, not the RFC description.
| Code | RFC Description | Emitted Name |
|---|---|---|
0 | kernel messages | Kernel |
1 | user-level messages | User |
2 | mail system | Mail |
3 | system daemons | System |
4 | security/authorization messages | Security |
5 | messages generated internally by syslogd | Syslogd |
6 | line printer subsystem | Line printer |
7 | network news subsystem | Network news |
8 | UUCP subsystem | UUCP |
9 | clock daemon | Clock |
10 | security/authorization messages | Security |
11 | FTP daemon | FTPd |
12 | NTP subsystem | NTPd |
13 | log audit | Log audit |
14 | log alert | Log alert |
15 | clock daemon | Clock daemon |
16–23 | local use 0 through 7 | Local 0 to Local 7 |
Severity Levels
| Code | Level |
|---|---|
0 | Emergency |
1 | Alert |
2 | Critical |
3 | Error |
4 | Warning |
5 | Notice |
6 | Informational |
7 | Debug |
These names are emitted verbatim in log.syslog.severity.name.
Parsing Behavior
The format is detected rather than declared. After the PRI, a single digit followed by a space is read as the RFC 5424 VERSION; anything else is parsed as RFC 3164.
A message with no PRI is accepted, not rejected. It is treated as facility 0 and severity 6.
Beyond the RFC fields, parsing produces:
| Field | Description |
|---|---|
format | Set to CEF or LEEF when the message body is in one of those formats. Vendor-prefixed variants such as ASM:CEF:0 are recognized, and the body is rewritten to begin at the format marker |
structured_data | RFC 5424 structured data, parsed into key-value pairs. Also accepts the Check Point dialect, which uses colons and semicolons and often omits the element identifier |
pid_raw | The process identifier when it is not numeric, which RFC 5424 permits |
unmapped | The token in the MSGID position, and any other unrecognized trailing header token |
format is the field most worth knowing about: downstream routing commonly branches on it to send CEF and LEEF traffic through the right pipeline.
Structured data is not available when the syslog processor writes directly to a table, as the table has no column for nested parameters.