Syslog (RFC 3164 / RFC 5424)
| Format | Syslog (RFC 3164 / RFC 5424) |
|---|---|
| Short name | Syslog |
| Category | log |
| Platforms | macOS, Linux |
| Crush support | Supported (LogParser) |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
Text log format of Unix-like systems and network devices: one message per line with priority, timestamp, host name, process tag and message. RFC 3164 timestamps have no year and no time zone; RFC 5424 uses full ISO 8601 timestamps with offset. Files written by the local syslog daemon usually omit the priority, and many current distributions write RFC 3339 timestamps with sub-second precision. Found in /var/log on Linux (messages, syslog, auth.log, secure — often without extension) and in exports from routers, firewalls and appliances.
Signatures
None recorded
Known extensions
.log
References
- The BSD syslog Protocol (RFC 3164) https://www.rfc-editor.org/rfc/rfc3164.html
- The Syslog Protocol (RFC 5424) https://www.rfc-editor.org/rfc/rfc5424.html
Cite this entry
Crush Format Reference, “Syslog (RFC 3164 / RFC 5424)”. https://kalink0.github.io/crush-forensics/formats/syslog/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction