Cluster
The network operations RFCs, explained
These are the RFCs you meet when you run a network rather than build one. Two of them are about how a device tells you what happened: RFC 5424 is the modern syslog format, RFC 3164 the old one that most devices still emit. The third, RFC 2544, is about how you measure whether the device is fast enough to bother logging.
Syslog is really two protocols wearing one name. RFC 3164 is Informational, published in 2001, and it only wrote down what BSD Unix had already been doing for twenty years, year-less timestamp and all. RFC 5424 is the proper redesign: a real RFC 3339 timestamp with a year and a timezone, named header fields, and an optional block of structured data a machine can parse. New systems should target 5424, and yet your firewall almost certainly still speaks 3164. Any log collector has to understand both, which is the practical reason both pages exist.
A useful rule when the two get confused: if the line begins with a bracketed number and a timestamp that forgot the year, you are looking at 3164. If it has a version digit and a full RFC 3339 timestamp, it is 5424. Neither RFC defines the transport; UDP on port 514 comes from RFC 5426, TLS on 6514 from RFC 5425.
RFC 2544 answers a different question entirely. Before you trust a router, switch or firewall, you want to know its throughput, its latency and where it starts dropping frames. RFC 2544 is the benchmarking methodology everyone quotes for exactly that, and its keyword difficulty of zero says something about how little anyone has bothered to explain it.
Start here
Three pages. The first two are a pair; read them together:
-
RFC 5424 Today's syslog
Syslog, with a real timestamp at last.
The modern log message format: a real timestamp, named fields, structured data. What new systems should emit.
-
RFC 3164 The one still spoken
The syslog format that was never really a standard.
The old BSD syslog, obsolete on paper and ubiquitous on the wire. Informational, never a standard, and the reason parsers cannot drop support.
-
RFC 2544 How you measure it
The MOT test for network boxes, explained.
Benchmarking methodology for network devices: throughput, latency, frame loss, back-to-back frames. The number on the datasheet came from here.