Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
What is the difference between the RFC 3164 (BSD) and RFC 5424 Syslog formats?
Short answer
Both are header standards of the Syslog message. RFC 3164 (BSD) is the traditional and widespread format: after the priority value, the timestamp without a year and the hostname, the application name is added to the start of the message body in the form application_name: message. RFC 5424 is the current standard: the version number, the full timestamp with time zone, the hostname and APP-NAME are separate, defined header fields; the application name is carried in the APP-NAME field, which makes parsing easier. In the TR7 Log Forwarding profile, both are offered in the Syslog Format field, and the default is RFC 3164 (BSD); the application name comes from the Application Name field (default TR7_syslog_client). Which format to select depends on the support of the receiving Syslog server or SIEM.
Where It Is Used in TR7
| Where | Field / label | What for |
|---|---|---|
| Settings → General Settings → Log Forwarding → Add | Syslog Format: RFC 3164 (BSD) / RFC 5424 | The Syslog header format of the device logs |
| Same form | Application Name (default TR7_syslog_client) | Written to the start of the message in RFC 3164, and to the APP-NAME field in RFC 5424 |
| AGS → Integrations → Log Forwarding | Syslog Format: RFC 3164 (BSD) (default) / RFC 5424 | The Syslog header format of the AGS audit events |
| Load Balancer → Profiles → Logs | Log Standard: local (default), rfc3164, rfc5424, priority, raw | The Syslog sending standard of the vService logs |
Comparison
| RFC 3164 (BSD) | RFC 5424 | |
|---|---|---|
| Status | Informational RFC that documents existing implementations | Standard |
| Timestamp | Mmm dd hh:mm:ss (no year or time zone) | ISO 8601, with time zone and fractional seconds |
| Application name | At the start of the message body (TR7_syslog_client: …) | Separate APP-NAME field |
| Structured data | None | STRUCTURED-DATA field |
| Where it fits | Old or simple Syslog servers | Current log servers and SIEMs |
Common Misconceptions
- "Syslog format determines the message content." Syslog format determines only the header; the format of the body is selected separately in the Message Format field (What is the difference between the JSON, CEF and Plain Text message formats for log forwarding?).
- "RFC 5424 works on every receiver." Old Syslog servers may expect only RFC 3164; the support of the receiver is verified.
- "Application name is used only in RFC 5424." In RFC 3164, too, it is added to the start of the message; it serves to tell TR7 records apart on the log server.
How it is done in the documentation
