RFC 5424 — Syslog Protocol

Q: What does the Introduction section cover in RFC 5424 — Syslog Protocol?

The Introduction section provides detailed technical specifications, security considerations, and implementation guidance as documented in RFC 5424 — Syslog Protocol. This content is part of the BLACKLABS RFC Reference Library.

Q: What does the Message Format section cover in RFC 5424 — Syslog Protocol?

The Message Format section provides detailed technical specifications, security considerations, and implementation guidance as documented in RFC 5424 — Syslog Protocol. This content is part of the BLACKLABS RFC Reference Library.

Q: What does the Severity Levels section cover in RFC 5424 — Syslog Protocol?

The Severity Levels section provides detailed technical specifications, security considerations, and implementation guidance as documented in RFC 5424 — Syslog Protocol. This content is part of the BLACKLABS RFC Reference Library.

Q: What does the Structured Data section cover in RFC 5424 — Syslog Protocol?

The Structured Data section provides detailed technical specifications, security considerations, and implementation guidance as documented in RFC 5424 — Syslog Protocol. This content is part of the BLACKLABS RFC Reference Library.

Q: What does the Transport Considerations section cover in RFC 5424 — Syslog Protocol?

The Transport Considerations section provides detailed technical specifications, security considerations, and implementation guidance as documented in RFC 5424 — Syslog Protocol. This content is part of the BLACKLABS RFC Reference Library.

BLACKLABS

RFC 5424 — Syslog Protocol

The Syslog Protocol — standardized logging framework for conveying event notification messages across IP networks, essential for security monitoring, incident detection, and compliance audit trails.

Standards Track March 2009 ISO 27001

1. Introduction

▶

The Syslog Protocol provides a standardized format for generating, transporting, and collecting log messages from diverse systems. It is the foundation of centralized security monitoring and compliance audit trails.

ISO 27001 Relevance: A.8.15 (Logging) — syslog provides the transport and format standard for security event logs. A.8.16 (Monitoring Activities) — enables centralized SIEM integration. A.5.28 (Collection of Evidence) — structured, timestamped logs for forensic analysis.

2. Message Format

▶

Syslog messages follow a structured format with a header and structured data:

  <PRI>VERSION TIMESTAMP HOSTNAME APP-NAME PROCID MSGID SD MSG

  Example:
  <34>1 2026-03-29T17:30:00.000Z nrf.5gc.mnc001.mcc001 amf 1234 AUTH
  [meta sequenceId="1"] User authentication failed for SUPI 001010123456789

Priority (PRI) = Facility × 8 + Severity

3. Severity Levels

▶

Value	Severity	Description	ISO Relevance
0	Emergency	System is unusable	A.5.24 Incident Response
1	Alert	Action must be taken immediately	A.8.16 Monitoring
2	Critical	Critical conditions	A.8.16 Monitoring
3	Error	Error conditions	A.8.15 Logging
4	Warning	Warning conditions	A.8.15 Logging
5	Notice	Normal but significant	A.8.15 Logging
6	Informational	Informational messages	A.8.15 Logging
7	Debug	Debug-level messages	Development only

4. Structured Data

▶

Syslog supports structured data elements (SD-ELEMENT) for machine-parsable metadata:

SD-ID: Identifies the type of structured data (e.g., timeQuality, origin, meta)
SD-PARAM: Key-value pairs within an SD element
IANA registry: Standard SD-IDs registered for interoperability

Structured data enables SIEM correlation and automated alerting per A.8.16.

5. Transport Considerations

▶

Syslog messages can be transported over:

Transport	RFC	Security
UDP (port 514)	RFC 5426	No encryption — NOT recommended for A.8.24
TLS (port 6514)	RFC 5425	Encrypted, authenticated — RECOMMENDED
DTLS	RFC 6012	Encrypted datagram transport

ISO A.8.24: Log transport MUST be encrypted. Use RFC 5425 (TLS) for syslog to prevent log tampering and eavesdropping.

6. Security Considerations

▶

Log integrity: Use TLS transport to prevent forgery and tampering (A.8.24)
Clock synchronization: Accurate timestamps require NTP (RFC 5905) — critical for forensic timeline reconstruction
Log retention: Define retention periods per A.5.28 and regulatory requirements
Access control: Restrict who can read/modify logs — separation of duties (A.5.3)
Overflow protection: Rate limiting and buffer management to prevent log loss during events