Submit a ticketCall us
Home > Success Center > Log & Event Manager (LEM) > Log & Event Manager (LEM) Documentation > Log forwarding RFC message formats in LEM

Log forwarding RFC message formats in LEM

Table of contents
No headers

Updated: September 4, 2018

LEM supports log forwarding in two RFC formats: RFC 3164 and RFC 5424. Unlike RFC5424, RFC3164 does not contain the year or time zone in the message header.

See the following message examples:

  • RFC3164: Jul 12 11:11:11 10.199.10.2 appName: RFC3164 message 
  • RFC5424: 2018-07-12T11:11:11.111Z 10.199.10.2 appName pid - - RFC5424 message
  • You can specify a token using RFC 5424, which is mandatory for forwarding to Loggly.
  • Both formats can be logged by endpoint in a different format. For example, you can convert the timestamp to a Linux timestamp.

Raw message example:

facility: local use 0 (local0)
severity: Warning
RFC3164
message example: <132> Jul 12 11:11:11 10.199.10.2 appName: RFC3164 message
RFC5424
message example: <132>1 2018-07-12T11:11:11.111Z 10.199.10.2 appName pid - - RFC5424 message

When choosing a format, consider the supported formats related to other SolarWinds products and features:

  • Orion Logs: Both 
  • Kiwi Syslog: RFC3164
  • Loggly: Both
  • Syslog-ng: Depends on the configuration
  • Papertrail: Both
     

 

 

Last modified

Tags

Classifications

Public