The syslog protocol has been in use for decades as a way to transport messages from network devices to a logging server, typically known as a syslog server. Due to its longevity and popularity, the syslog protocol has support on most major operating systems, including macOS, Linux, and Unix.
Syslog is a way for network devices to send event messages to a logging server – usually known as a Syslog server. The Syslog protocol is supported by a wide range of devices and can be used to log different types of events.
While there is undoubtedly some standardization in syslog message formats, you can expect to see different syslog message types in the wild. Let’s compare two example messages to visualize some of the differences between the two most popular formats, RFC3164 and RFC 5424.