Submit a ticketCall us

Training ClassSign up for Network Performance Monitor (NPM) and Scalability instructor-led classes

Attend our instructor-led classes, provided by SolarWinds® Academy, to discuss the more advanced monitoring mechanisms available in NPM as well as how to tune your equipment to optimize its polling capabilities. NPM classes offered:
NPM Custom Monitoring and Polling
Orion Platform Scalability

Reserve your seat.

Home > Success Center > Log & Event Manager (LEM) > Log & Event Manager (LEM) Documentation > Log forwarding RFC message formats in LEM

Log forwarding RFC message formats in LEM

Table of contents
No headers

Updated: September 4, 2018

LEM supports log forwarding in two RFC formats: RFC 3164 and RFC 5424. Unlike RFC5424, RFC3164 does not contain the year or time zone in the message header.

See the following message examples:

  • RFC3164: Jul 12 11:11:11 appName: RFC3164 message 
  • RFC5424: 2018-07-12T11:11:11.111Z appName pid - - RFC5424 message
  • You can specify a token using RFC 5424, which is mandatory for forwarding to Loggly.
  • Both formats can be logged by endpoint in a different format. For example, you can convert the timestamp to a Linux timestamp.

Raw message example:

facility: local use 0 (local0)
severity: Warning
message example: <132> Jul 12 11:11:11 appName: RFC3164 message
message example: <132>1 2018-07-12T11:11:11.111Z appName pid - - RFC5424 message

When choosing a format, consider the supported formats related to other SolarWinds products and features:

  • Orion Logs: Both 
  • Kiwi Syslog: RFC3164
  • Loggly: Both
  • Syslog-ng: Depends on the configuration
  • Papertrail: Both



Last modified