syslog Parameters

Created
2001-08-21
Last Updated
2016-04-26
Note
The syslog protocol utilizes numerical facility and severity values.
Available Formats

XML
HTML
Plain text

Registries Included Below

syslog Message Facilities

Registration Procedure(s)
IETF Review
Reference
[RFC5424]
Available Formats

CSV
Numerical Code Facility Reference
0 kernel messages [RFC5424]
1 user-level messages [RFC5424]
2 mail system [RFC5424]
3 system daemons [RFC5424]
4 security/authorization messages [1] [RFC5424]
5 messages generated internally by syslogd [RFC5424]
6 line printer subsystem [RFC5424]
7 network news subsystem [RFC5424]
8 UUCP subsystem [RFC5424]
9 clock daemon [2] [RFC5424]
10 security/authorization messages [1] [RFC5424]
11 FTP daemon [RFC5424]
12 NTP subsystem [RFC5424]
13 log audit [1] [RFC5424]
14 log alert [1] [RFC5424]
15 clock daemon [2] [RFC5424]
16 local use 0 (local0) [RFC5424]
17 local use 1 (local1) [RFC5424]
18 local use 2 (local2) [RFC5424]
19 local use 3 (local3) [RFC5424]
20 local use 4 (local4) [RFC5424]
21 local use 5 (local5) [RFC5424]
22 local use 6 (local6) [RFC5424]
23 local use 7 (local7) [RFC5424]

syslog Message Severities

Registration Procedure(s)
IETF Review
Reference
[RFC5424]
Note
REGISTRY FULL
Available Formats

CSV
Numerical Code Severity Reference
0 Emergency: system is unusable [RFC5424]
1 Alert: action must be taken immediately [RFC5424]
2 Critical: critical conditions [RFC5424]
3 Error: error conditions [RFC5424]
4 Warning: warning conditions [RFC5424]
5 Notice: normal but significant condition [RFC5424]
6 Informational: informational messages [RFC5424]
7 Debug: debug-level messages [RFC5424]

syslog Version Values

Registration Procedure(s)
Standards Action
Reference
[RFC5424]
Available Formats

CSV
Version Format Reference
1 Defined in [RFC5424] [RFC5424]

syslog Structured Data ID Values

Registration Procedure(s)
IETF Review
Reference
[RFC5424]
Note
The registration rules for this registry will be that
new Structured Data ID values and new Parameter Name
values must be registered via IETF Review. In addition,
once SD-IDs and SD-PARAMs are defined, the syntax and
semantics of these registrations must not be altered.
In the event that modifications of existing registry items
are required, a new SD-ID or SD-PARAM must be created,
leaving the older one unchanged. Finally, the IANA does
not register, and will not control SD-IDs or SD-PARAMs
\with an "@" sign (ABNF %d64) in them.
Available Formats

CSV
Structured Data ID Structured Data Parameter Mandatory or Optional Reference
timeQuality OPTIONAL [RFC5424]
tzKnown OPTIONAL [RFC5424]
isSynced OPTIONAL [RFC5424]
syncAccuracy OPTIONAL [RFC5424]
origin OPTIONAL [RFC5424]
ip OPTIONAL [RFC5424]
enterpriseId OPTIONAL [RFC5424]
software OPTIONAL [RFC5424]
swVersion OPTIONAL [RFC5424]
meta OPTIONAL [RFC5424]
sequenceId OPTIONAL [RFC5424]
sysUpTime OPTIONAL [RFC5424]
language OPTIONAL [RFC5424]
snmp OPTIONAL [RFC5675]
ctxEngine OPTIONAL [RFC5675]
ctxName OPTIONAL [RFC5675]
v<N> OPTIONAL [RFC5675]
l<N> OPTIONAL [RFC5675]
o<N> OPTIONAL [RFC5675]
x<N> OPTIONAL [RFC5675]
c<N> OPTIONAL [RFC5675]
C<N> OPTIONAL [RFC5675]
u<N> OPTIONAL [RFC5675]
d<N> OPTIONAL [RFC5675]
i<N> OPTIONAL [RFC5675]
n<N> OPTIONAL [RFC5675]
p<N> OPTIONAL [RFC5675]
t<N> OPTIONAL [RFC5675]
a<N> OPTIONAL [RFC5675]
alarm OPTIONAL [RFC5674]
resource MANDATORY [RFC5674]
probableCause MANDATORY [RFC5674]
perceivedSeverity MANDATORY [RFC5674]
eventType OPTIONAL [RFC5674]
trendIndication OPTIONAL [RFC5674]
resourceURI OPTIONAL [RFC5674]
ssign MANDATORY [RFC5848]
VER MANDATORY [RFC5848]
RSID MANDATORY [RFC5848]
SG MANDATORY [RFC5848]
SPRI MANDATORY [RFC5848]
GBC MANDATORY [RFC5848]
FMN MANDATORY [RFC5848]
CNT MANDATORY [RFC5848]
HB MANDATORY [RFC5848]
SIGN MANDATORY [RFC5848]
ssign-cert MANDATORY [RFC5848]
VER MANDATORY [RFC5848]
RSID MANDATORY [RFC5848]
SG MANDATORY [RFC5848]
SPRI MANDATORY [RFC5848]
TPBL MANDATORY [RFC5848]
INDEX MANDATORY [RFC5848]
FLEN MANDATORY [RFC5848]
FRAG MANDATORY [RFC5848]
SIGN MANDATORY [RFC5848]
PCNNode OPTIONAL [RFC6661]
ID MANDATORY [RFC6661]
Rtyp MANDATORY [RFC6661]
PCNTerm OPTIONAL [RFC6661]
IngrID MANDATORY [RFC6661]
EgrID MANDATORY [RFC6661]
TermRate MANDATORY [RFC6661]
FCnt MANDATORY [RFC6661]

syslog-sign Protocol Version Values

Registration Procedure(s)
IETF Review
Reference
[RFC5848]
Available Formats

CSV
Value Protocol Version Reference
00 Reserved [RFC5848]
01 Defined in [RFC5848] [RFC5848]
02-50 Unassigned
51-99 Reserved for Private Use [RFC5848]

syslog-sign Hash Algorithm Values

Registration Procedure(s)
IETF Review
Reference
[RFC5848]
Note
New values are assigned incrementally from 0-9, then from a-z, then from A-Z.
Available Formats

CSV
Value Protocol Version Hash Algorithm Reference
0 01 Reserved [RFC5848]
1 01 SHA1 [RFC5848]
2 01 SHA256 [RFC5848]

syslog-sign Signature Scheme Values

Registration Procedure(s)
IETF Review
Reference
[RFC5848]
Note
The range for values is 0-9.
Available Formats

CSV
Value Protocol Version Signature Scheme Reference
0 01 Reserved [RFC5848]
1 01 OpenPGP DSA [RFC5848]

syslog-sign SG Field Values

Registration Procedure(s)
IETF Review
Reference
[RFC5848]
Available Formats

CSV
Value Meaning Reference
0 There is only one Signature Group. [RFC5848]
1 Each PRI value is associated with its own Signature Group. [RFC5848]
2 Each Signature Group contains a range of PRI Values. [RFC5848]
3 Signature Groups are not assigned with any of the above relationships to PRI values of the syslog messages they sign. [RFC5848]
4-7 Unassigned
8-9 Reserved for Private Use [RFC5848]

syslog-sign Key Blob Type Values

Registration Procedure(s)
IETF Review
Reference
[RFC5848]
Note
Upper-case letters are assigned by IANA. Lower-case letters are vendor-specific.
Available Formats

CSV
Value Key Blob Type Reference
C a PKIX certificate [RFC5848]
P an OpenPGP certificate [RFC5848]
K the public key whose corresponding private key is used to sign the messages [RFC5848]
N no key information sent, key is pre-distributed [RFC5848]
U installation-specific key exchange information [RFC5848]

Footnotes

[1] 
Various operating systems have been found to utilize
Facilities 4, 10, 13 and 14 for security/authorization,
audit, and alert messages which seem to be similar.
[2] 
Various operating systems have been found to utilize
both Facilities 9 and 15 for clock (cron/at) messages.