rfc·explained

RFC 3164 · · Informational (obsoleted by 5424)

The syslog format that was never really a standard.

The official title is "The BSD syslog Protocol." What it actually is: a written-down snapshot of the messy syslog format Unix machines had already spoken for twenty years, no year in the timestamp and all. Obsoleted by RFC 5424, yet still the dialect most devices emit.

Status
Obsoleted
Replaced by
RFC 5424

Written by Noel Lang · IT trainer

TL;DR

RFC 3164 is the old BSD syslog format, written down after the fact. It is Informational, not a standard: it described the log-message convention Unix machines had already spoken for twenty years, complete with a timestamp that has no year and no timezone. RFC 5424 obsoletes it, yet most network devices still emit the 3164 dialect, so every log parser has to understand it.

The problem it solves

For about twenty years, “syslog” was not written down anywhere. It was simply what BSD Unix started doing in the 1980s, copied from machine to machine until half the internet spoke it, with every implementation improvising the details slightly differently. There was no document to point at, no way to say “you are doing syslog wrong”, because there was no definition of doing it right.

RFC 3164’s job was to end that silence. It did not invent a format; it wrote down the one already in use, warts and all. That is what “Informational” means here: the authors took an autopsy of a living, messy protocol and published the notes, so that at least everyone could disagree from the same page.

The dictionary, not the grammar book

Think of the difference between a dictionary and a grammar textbook. A grammar book tells you how you should write. A dictionary records how people already speak, slang and irregularities included, and quietly notes where usage is inconsistent.

RFC 3164 is the dictionary. It documents that a syslog line has a priority number, a timestamp, a hostname and a message, and it honestly admits how often real devices mangle even that. RFC 5424 is the grammar book that came later, telling everyone how it should be done. Both are useful, but only one is prescriptive, and confusing the two is where most of the misunderstanding starts.

The timestamp that forgot the year

If RFC 3164 has one infamous legacy, it is the clock. The timestamp is Mmm dd hh:mm:ss, for example Oct 11 22:14:15, in the sender’s local time. No year. No timezone. No fractions of a second. It was fine when you read one machine’s log on that same machine, and close to useless the moment you gather logs from servers in three countries and try to reconstruct an incident minute by minute. Fixing exactly this is why RFC 5424 reached for a strict RFC 3339 timestamp.

The anatomy of a 3164 line

The format’s own example, straight from the RFC: a failed su to root. Five loose parts, and the timestamp is the weak one. The same event under RFC 5424 would carry a full year and timezone.

<34>PRIOct 11 22:14:15TIMESTAMP · no year, no tzmymachineHOSTNAMEsu:TAG‘su root’ failed for lonvickMSG · free text
The whole line, priority to message, must fit in 1024 bytes. The dashed field is the one RFC 5424 rebuilt: a real timestamp with a year and a timezone.

What the RFC actually says

The original is short and refreshingly candid about being a description, not a rulebook. The map, if you go to the source:

Section In plain words
1 · Introduction An unusually honest opening: this is not a specification, it is a description of what syslog implementations already do in the wild.
4.1 · Message parts The heart of it: a message is PRI + HEADER + MSG, and the whole packet must fit in 1024 bytes.
4.1.1 · PRI The angle-bracket number and the facility × 8 + severity formula, the same priority stamp RFC 5424 later kept.
4.1.2 · HEADER The famous flaw: a Mmm dd hh:mm:ss timestamp with no year and no timezone, followed by the hostname.
5 · Conventions A frank catalogue of how sloppy real deployments are, and gentle advice for relays trying to make sense of them.

Things people get wrong

  • "RFC 3164 was the syslog standard."

    It never was. RFC 3164 is Informational, which in IETF terms means "here is what people already do", not "here is what you must do". It documented BSD syslog after the fact, in 2001, decades after the format took hold. The first actual standards-track syslog specification is its successor, RFC 5424. The predecessor described; the successor prescribes.

  • "It is obsolete, so nobody uses it."

    The opposite is true. Being obsoleted by RFC 5424 changed the paperwork, not the reality. A huge share of firewalls, switches and legacy daemons still emit the 3164 format every second, which is exactly why parsers cannot drop support for it. Obsolete on paper, ubiquitous on the wire.

  • "The 3164 timestamp includes the year."

    It does not. The format is Mmm dd hh:mm:ss in local time, with no year, no timezone and no sub-second precision. Collect logs from three continents and you cannot reliably line up what happened when. That one gap is the single best argument for moving to RFC 5424.

Where you'll still meet the 3164 format

For an obsolete format, it is astonishingly alive. How to spot it in the wild:

You see What it means
Oct 11 22:14:15 host ... A year-less, timezone-less timestamp at the start of a log line is the unmistakable fingerprint of the 3164 format.
Cisco, Fortinet, MikroTik logs Most network gear still speaks 3164 by default. This is why central log collectors must parse both formats.
/var/log/messages on older systems The classic BSD-style line written to disk is 3164-flavoured, long after 5424 became the standard.
A parser that "loses" the year Logs that show the wrong year in January, or guess it, are downstream tools filling in what the 3164 timestamp never carried.

Questions people actually ask

What is RFC 3164? +

RFC 3164 is the Informational document from 2001 that wrote down the BSD syslog format, the loose log-message convention Unix systems had already used for decades. It defines the parts of a message: the priority number in angle brackets, a timestamp, a hostname, a tag and the free-text message. It was never a real standard, and RFC 5424 has since obsoleted it, but most network devices still emit the 3164 format.

Is RFC 3164 still used? +

Yes, heavily, even though it is obsolete. Countless firewalls, switches, routers and older daemons still emit the 3164 format, which is why any log parser has to handle it alongside the newer RFC 5424. It is the rare case where the officially retired predecessor never actually left.

What is the difference between RFC 3164 and RFC 5424? +

RFC 3164 only described what BSD syslog already did, including its imprecise timestamp with no year and no timezone. RFC 5424 is a proper redesign with an RFC 3339 timestamp (year, timezone, sub-second precision), named header fields and optional structured data. In short: 3164 described the old habit, 5424 prescribes a real format. New systems should target 5424.

What is the RFC 3164 timestamp format? +

It is Mmm dd hh:mm:ss in local time, for example Oct 11 22:14:15, with the day space-padded to two characters. It has no year, no timezone and no sub-second precision, which is close to useless once you collect logs from machines in different time zones. That single weakness is the main reason RFC 5424 exists.

Referenced by

Other explainers on this site that point back to this RFC:

How RFC 3164 connects

Part of a guided cluster: The network operations RFCs, explained