Security Compliance

Log forwarding RFC message formats in SEM

This article lists the correct RFC settings for log forwarding with SEM.

First published date

4/23/2019 1:17 PM

Last published date

8/10/2022 4:48 PM

Overview

SEM, formerly Log & Event Manager, supports log forwarding in two RFC formats: RFC 3164 and RFC 5424. Unlike RFC 5424, RFC 3164 does not contain the year or time zone in the message header.

Product section

Security Event Manager

Resolution

See the following message examples:

  • RFC3164: Jul 12 11:11:11 10.199.10.2 appName: RFC3164 message 
  • RFC5424: 2018-07-12T11:11:11.111Z 10.199.10.2 appName pid - - RFC5424 message
NOTE:
  • You can specify a token using RFC 5424, which is mandatory for forwarding to Loggly.
  • Both formats can be logged by endpoint in a different format. For example, you can convert the timestamp to a Linux timestamp.

Raw message example:

facility: local use 0 (local0)
severity: Warning
RFC3164
message example: <132> Jul 12 11:11:11 10.199.10.2 appName: RFC3164 message
RFC5424
message example: <132>1 2018-07-12T11:11:11.111Z 10.199.10.2 appName pid - - RFC5424 message

When choosing a format, consider the supported formats related to other SolarWinds products and features:

  • Orion Logs: Both 
  • Kiwi Syslog: RFC 3164
  • Loggly: Both
  • Syslog-ng: Depends on the configuration
  • Papertrail: Both