Syslog Message Parser & Builder

Decode and compose syslog messages in RFC 5424 and RFC 3164 (BSD) formats — split the PRI value into facility and severity, parse structured-data elements, and assemble new lines field by field.

Parse a Syslog Line

Raw syslog message

Build a Syslog Message

Format

Facility

Severity

Hostname

App-Name / Tag

PROCID / PID (5424 only)

MSGID (5424 only)

Structured Data (5424 only, e.g. [exampleSDID@32473 iut="3" eventSource="App"])

MSG

Timestamp (leave blank for now)

PRI ↔ Facility/Severity

PRI = facility × 8 + severity (range 0–191). Enter any of the three to see the other two.

PRI

Facility

Severity

Facility & Severity Reference

Facilities (0–23)

Severities (0–7)

About Syslog

RFC 5424 is the modern syslog protocol, with a strict wire format: <PRI>VERSION SP TIMESTAMP SP HOSTNAME SP APP-NAME SP PROCID SP MSGID SP STRUCTURED-DATA SP MSG. Missing values use the NILVALUE -. Structured data elements are bracketed: [SD-ID@PEN k="v" k2="v2"].

RFC 3164 is the legacy BSD format, widely emitted by routers, switches, and older Unix daemons: <PRI>TIMESTAMP SP HOSTNAME SP TAG[PID]: MSG. The timestamp uses MMM dd HH:MM:SS with no year and no timezone.

The PRI value packs two fields: facility = PRI >> 3 and severity = PRI & 0x07. Severity 0 (emerg) is the most urgent, 7 (debug) the least.