RFC 5424 syslog message structure and transport boundaries

RFC 5424 defines a syslog message format; it does not mandate one network transport. A message contains PRI, VERSION, TIMESTAMP, HOSTNAME, APP-NAME, PROCID, MSGID, STRUCTURED-DATA, and an optional MSG. A hyphen is the NILVALUE for fields with no value. PRI combines facility and severity. Timestamps can carry a time-zone offset and fractional seconds, but the format does not guarantee millisecond precision or an accurate source clock. An originator can optionally use structured data such as timeQuality to describe its confidence in the clock.

Expert perspective: an RFC author and implementer on structured data

Rainer Gerhards, author of RFC 5424 and a syslog implementer, explains in a separate technical analysis that structured data provides syntax for named elements and parameters but does not define a general application data model or the meaning of each field. Adding [exampleSDID@32473 userId="…"] therefore does not make every collector understand userId consistently. Producers and consumers still need an agreement about SD-ID ownership, parameter semantics, versioning, privacy, and parser behavior. Even the standard’s registered elements such as timeQuality are optional.

TLS and delivery reliability are separate concerns

RFC 5425 defines a TLS transport mapping for syslog to provide peer authentication and protection in transit when correctly configured. RFC 5424’s message syntax does not enable TLS or prevent log loss. TLS over TCP provides ordered bytes within a live transport session, but it does not define the sender’s queueing, retry, or durable storage after a connection failure. Certificate validation, trust roots, and whether mutual TLS is required remain deployment decisions. UDP syslog has no transport acknowledgement or retransmission, so its loss behavior is different.

Framing, parsing, and operational checks

RFC 5424 specifies message syntax and field interpretation; framing multiple messages on a stream is a transport-mapping concern. The TLS mapping uses octet-counting to delimit messages. Implementations should define message-size limits and behavior for multiple messages per connection, malformed structured data, and invalid encodings. Structured fields can simplify parsing, but MSG may remain free-form and collectors may normalize or discard fields differently. In the full pipeline, check raw-message retention, clock offset and time-zone handling, schema normalization, queue capacity during outages, and dropped-message metrics.

References