Documentation
¶
Overview ¶
Package syslog decodes syslog messages in both the modern RFC 5424 (IETF) format and the legacy RFC 3164 (BSD) format. Syslog is the lingua franca of log aggregation — every operating system, network device, container runtime, and SIEM agent emits it.
Wrap-vs-native judgement ¶
Native. Both syslog formats are plain ASCII text with a well-bounded grammar. Pasting a line from journalctl / /var/log/messages / a Splunk extraction / a Wireshark follow-stream of UDP/514 is enough — no log shipper, no SIEM agent, no live network attach.
What this package covers ¶
**PRI** (priority value) — the leading `<NNN>` integer in every syslog message broken out as facility (kern, user, mail, daemon, auth, syslog, lpr, news, uucp, cron, authpriv, ftp, ntp, audit, alert, clock daemon, local0..local7) + severity (Emergency / Alert / Critical / Error / Warning / Notice / Informational / Debug) name lookup per RFC 5424 §6.2.
**Format auto-detection** — the byte immediately after `<PRI>` distinguishes the two formats: a digit means RFC 5424 (the `VERSION` field, always `1` in current practice); anything else is treated as RFC 3164.
**RFC 5424 IETF format** (modern, structured):
<PRI>1 TIMESTAMP HOSTNAME APP-NAME PROCID MSGID [SD-ID-1@PEN key1="val1" key2="val2"] [SD-ID-2 ...] MSG
Fields use `-` for nil. TIMESTAMP is RFC 3339 with optional sub-second precision and offset. Structured data is a list of `[SD-ID PARAM-NAME="value" ...]` groups; the decoder walks them into named entries with key/value maps.
**RFC 3164 BSD format** (legacy):
<PRI>TIMESTAMP HOSTNAME TAG[PID]: MSG
TIMESTAMP is `Mmm dd hh:mm:ss` (with the year missing — operators infer it). TAG is the process name; if it ends in `[NNN]:` the PID is split out.
**Severity highlighting** — the integer severity is surfaced both as a number and a name; the operationally important "Critical / Alert / Emergency" levels are trivially greppable in the JSON output.
What this package does NOT cover (deliberately out of scope) ¶
- Transport framing: RFC 6587 (TCP framing with `\n` or octet count) and RFC 5425 (TLS) — operators feed a single message at a time after stripping the transport wrapper.
- Cisco / Juniper / vendor-extension formats (e.g. `*Mar 24 12:34:56.789 UTC: %SYS-5-CONFIG_I:`) — the PRI + message body are still extracted, but the vendor-specific fields (sequence number, mnemonic, facility-severity-mnemonic) are exposed as part of the message text rather than broken out.
- CEF / LEEF / Common Event Format payloads — these are wrappers around the syslog message body and warrant a separate Spec.
- Octet escaping inside structured-data parameter values (`\\"`, `\\\\`, `\\]`) — handled per RFC 5424 §6.3.3. Edge cases with unbalanced escapes are surfaced as-is.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Message ¶
type Message struct {
Format string `json:"format"`
Raw string `json:"raw"`
Priority int `json:"priority"`
Facility int `json:"facility"`
FacilityName string `json:"facility_name"`
Severity int `json:"severity"`
SeverityName string `json:"severity_name"`
Version int `json:"version,omitempty"`
Timestamp string `json:"timestamp,omitempty"`
Hostname string `json:"hostname,omitempty"`
AppName string `json:"app_name,omitempty"`
ProcID string `json:"proc_id,omitempty"`
MsgID string `json:"msg_id,omitempty"`
Tag string `json:"tag,omitempty"`
StructuredData []StructuredDataElement `json:"structured_data,omitempty"`
Message string `json:"message,omitempty"`
}
Message is the decoded syslog message view.
Source Files