RFC 5424 和系统日志

Question

When I print content of my log files in /var/log directory for instance head /var/log/messages it seems like the messages are not completley compliant with RFC5424 as described here . First obvious difference is that there is no version at the begging of my log messages. It is not by the rules of RFC5424 on my Ubuntu neither on Fedora
I would like to know what does that mean for the syslog format itself. Is it completly unique and doesn't actually follow any specific syntax or does it mean that it has it's own syntax for local PCs I'm not familiar with?

Answer 1

The format of messages in your system log are typically determined by your logging daemon. This can change based on your distribution and configuration, my Debian installation for example uses rsyslogd . syslog-ng is another popular choice. You could research and change the format of messages by looking up and altering the configuration of whatever logging daemon you are using, again for example mine is in /etc/rsyslog.conf . If you want to understand your own system, you'll need to figure out what daemon you're using (a good starting point might be running ps -e | grep log ), and research that.

Logging formats themselves can vary pretty widely, despite the existence of standards like RFC 5424 and it's predecessor RFC 3164 . Windows has it's own system based around the Windows Event Log . Journald has a wide set of output formats, including JSON. Cisco device logs typically follow their own special format, which might require special consideration for some systems. And of course there are competing standards like the Common Event Format .

All of that to say it isn't uncommon for an individual system's format to be relatively unique. Usually centralized log aggregation services like Splunk or the ELK stack provide a level of normalization that helps with this issue at scale. But for a personal system, it's probably enough to just understand your own specific service, and work with that.