Contents Menu Expand Light mode Dark mode Auto light/dark, in light mode Auto light/dark, in dark mode Skip to content
rsyslog documentation
rsyslog documentation
  • About rsyslog
    • AI-First (Human-Controlled): Principles and Practice
    • History and Future of rsyslog
  • Getting Started with rsyslog
    • Installing rsyslog
    • Basic Configuration
    • Understanding the Default Configuration
    • Forwarding Logs
    • Next Steps
  • Configuration
    • Basic Structure
    • Output Modules
      • omamqp1: AMQP 1.0 Messaging Output Module
      • omazureeventhubs: Microsoft Azure Event Hubs Output Module
      • omclickhouse: ClickHouse Output Module
      • omczmq: Output module for ZeroMQ
      • omdtls: Output Module for DTLS Protocol over UDP
      • omelasticsearch: Elasticsearch Output Module
        • Server
        • Serverport
        • HealthCheckTimeout
        • esVersion.major
        • searchIndex
        • dynSearchIndex
        • searchType
        • dynSearchType
        • pipelineName
        • dynPipelineName
        • skipPipelineIfEmpty
        • asyncrepl
        • usehttps
        • timeout
        • indexTimeout
        • template
        • bulkmode
        • maxbytes
        • parent
        • dynParent
        • uid
        • pwd
        • errorFile
        • tls.cacert
        • tls.mycert
        • tls.myprivkey
        • allowunsignedcerts
        • skipverifyhost
        • bulkid
        • dynbulkid
        • writeoperation
        • retryfailures
        • retryruleset
        • ratelimit.interval
        • ratelimit.burst
        • rebindinterval
      • omfile: File Output Module
        • asyncWriting
        • closeTimeout
        • compression.driver
        • compression.zstd.workers
        • createDirs
        • cry.Provider
        • dirCreateMode
        • dirGroup
        • dirGroupNum
        • dirOwner
        • dirOwnerNum
        • dynaFile
        • dynafile.donotsuspend
        • dynaFileCacheSize
        • failOnChOwnFailure
        • File
        • fileCreateMode
        • fileGroup
        • fileGroupNum
        • fileOwner
        • fileOwnerNum
        • flushInterval
        • flushOnTXEnd
        • ioBufferSize
        • rotation.sizeLimit
        • rotation.sizeLimitCommand
        • sig.Provider
        • sync
        • Template
        • veryRobustZip
        • zipLevel
      • omfwd: syslog Forwarding Output Module
        • Basic Parameters
        • Module Parameters
      • omhdfs: Hadoop Filesystem Output Module
      • omhiredis: Redis Output Module
      • omhttp: HTTP Output Module
      • omhttpfs: Hadoop HTTPFS Output Module
      • omjournal: Systemd Journal Output
      • omkafka: write to Apache Kafka
        • Broker
        • Topic
        • Key
        • DynaKey
        • DynaTopic
        • DynaTopic.Cachesize
        • Partitions.Auto
        • Partitions.number
        • Partitions.useFixed
        • errorFile
        • statsFile
        • ConfParam
        • TopicConfParam
        • Template
        • closeTimeout
        • resubmitOnFailure
        • KeepFailedMessages
        • failedMsgFile
        • statsName
      • omlibdbi: Generic Database Output Module
      • ommail: Mail Output Module
      • ommongodb: MongoDB Output Module
      • ommysql: MariaDB/MySQL Database Output Module
      • omoracle: Oracle Database Output Module
      • PostgreSQL Database Output Module (ompgsql)
      • ompipe: Pipe Output Module
      • omprog: Program integration Output module
        • template
        • binary
        • confirmMessages
        • confirmTimeout
        • reportFailures
        • useTransactions
        • beginTransactionMark
        • commitTransactionMark
        • output
        • fileCreateMode
        • hup.signal
        • signalOnClose
        • closeTimeout
        • killUnresponsive
        • forceSingleInstance
      • omrabbitmq: RabbitMQ output module
      • omrelp: RELP Output Module
      • omruleset: ruleset output/including module
      • omsendertrack: Sender Tracking Output Module
      • omsnmp: SNMP Trap Output Module
      • omstdout: stdout output module (testbench tool)
      • omudpspoof: UDP spoofing output module
      • omusrmsg: notify users
      • omuxsock: Unix sockets Output Module
      • GuardTime Log Signature Provider (gt)
      • Keyless Signature Infrastructure Provider (ksi)
      • KSI Signature Provider (rsyslog-ksi-ls12)
    • Input Modules
      • im3195: RFC3195 Input Module
      • imbatchreport: Batch report input module
      • imczmq: Input module for ZeroMQ
      • imdocker: Docker Input Module
        • DockerApiUnixSockAddr
        • ApiVersionStr
        • PollingInterval
        • ListContainersOptions
        • GetContainerLogOptions
        • RetrieveNewLogsFromStart
        • DefaultFacility
        • DefaultSeverity
        • escapeLF
      • imdtls: Input Module for DTLS Protocol over UDP
      • imfile: Text File Input Module
        • addCeeTag
        • addMetadata
        • deleteStateOnFileDelete
        • deleteStateOnFileMove
        • discardTruncatedMsg
        • endmsg.regex
        • escapeLF
        • escapeLF.replacement
        • Facility
        • File
        • freshStartTail
        • ignoreOlderThan
        • MaxBytesPerMinute
        • MaxLinesAtOnce
        • MaxLinesPerMinute
        • MaxSubmitAtOnce
        • Mode
        • msgDiscardingError
        • needParse
        • persistStateAfterSubmission
        • PersistStateInterval
        • PollingInterval
        • readMode
        • readTimeout
        • reopenOnTruncate
        • Ruleset
        • Severity
        • sortFiles
        • startmsg.regex
        • stateFile
        • statefile.directory
        • Tag
        • timeoutGranularity
        • trimLineOverBytes
      • imgssapi: GSSAPI Syslog Input Module
        • GSSAPI module support in rsyslog v3
      • Imhiredis: Redis input plugin
      • imhttp: HTTP input module
      • imjournal: Systemd Journal Input Module
        • PersistStateInterval
        • FileCreateMode
        • StateFile
        • Ratelimit.Interval
        • Ratelimit.Burst
        • IgnorePreviousMessages
        • DefaultSeverity
        • DefaultFacility
        • UsePidFromSystem
        • UsePid
        • IgnoreNonValidStatefile
        • WorkAroundJournalBug
        • FSync
        • Remote
        • defaultTag
        • Main
      • imkafka: read from Apache Kafka
      • imklog: Kernel Log Input Module
      • imkmsg: /dev/kmsg Log Input Module
      • immark: Mark Message Input Module
      • Impcap: network traffic capture
      • improg: Program integration input module
      • impstats: Generate Periodic Statistics of Internal Counters
      • imptcp: Plain TCP Syslog
        • Threads
        • MaxSessions
        • ProcessOnPoller
        • Port
        • Path
        • DiscardTruncatedMsg
        • FileOwner
        • FileOwnerNum
        • FileGroup
        • FileGroupNum
        • FileCreateMode
        • FailOnChOwnFailure
        • Unlink
        • Name
        • Ruleset
        • MaxFrameSize
        • Address
        • AddtlFrameDelimiter
        • SupportOctetCountedFraming
        • NotifyOnConnectionClose
        • NotifyOnConnectionOpen
        • KeepAlive
        • KeepAlive.Probes
        • KeepAlive.Interval
        • KeepAlive.Time
        • RateLimit.Interval
        • RateLimit.Burst
        • Compression.mode
        • flowControl
        • MultiLine
        • framing.delimiter.regex
        • SocketBacklog
        • Defaulttz
        • Framingfix.cisco.asa
        • ListenPortFileName
      • imrelp: RELP Input Module
      • imsolaris: Solaris Input Module
      • imtcp: TCP Syslog Input Module
        • AddtlFrameDelimiter
        • DisableLFDelimiter
        • MaxFrameSize
        • NotifyOnConnectionOpen
        • NotifyOnConnectionClose
        • KeepAlive
        • KeepAlive.Probes
        • KeepAlive.Time
        • KeepAlive.Interval
        • FlowControl
        • MaxListeners
        • MaxSessions
        • StreamDriver.Name
        • WorkerThreads
        • StarvationProtection.MaxReads
        • StreamDriver.Mode
        • StreamDriver.AuthMode
        • StreamDriver.PermitExpiredCerts
        • streamDriver.checkExtendedKeyPurpose
        • StreamDriver.PrioritizeSAN
        • StreamDriver.TlsVerifyDepth
        • PermittedPeer
        • DiscardTruncatedMsg
        • gnutlsPriorityString
        • PreserveCase
        • Port
        • ListenPortFileName
        • Address
        • Name
        • Ruleset
        • SupportOctetCountedFraming
        • SocketBacklog
        • RateLimit.Interval
        • RateLimit.Burst
        • streamDriver.CAFile
        • streamDriver.CRLFile
        • streamDriver.KeyFile
        • streamDriver.CertFile
      • imtuxedoulog: Tuxedo ULOG input module
      • imudp: UDP Syslog Input Module
        • TimeRequery
        • SchedulingPolicy
        • SchedulingPriority
        • BatchSize
        • Threads
        • PreserveCase
        • Address
        • Port
        • IpFreeBind
        • Device
        • Ruleset
        • RateLimit.Interval
        • RateLimit.Burst
        • Name
        • Name.appendPort
        • DefaultTZ
        • RcvBufSize
      • imuxsock: Unix Socket Input Module
        • SysSock.IgnoreTimestamp
        • SysSock.IgnoreOwnMessages
        • SysSock.Use
        • SysSock.Name
        • SysSock.FlowControl
        • SysSock.UsePIDFromSystem
        • SysSock.RateLimit.Interval
        • SysSock.RateLimit.Burst
        • SysSock.RateLimit.Severity
        • SysSock.UseSysTimeStamp
        • SysSock.Annotate
        • SysSock.ParseTrusted
        • SysSock.Unlink
        • SysSock.UseSpecialParser
        • SysSock.ParseHostname
        • Ruleset
        • IgnoreTimestamp
        • IgnoreOwnMessages
        • FlowControl
        • RateLimit.Interval
        • RateLimit.Burst
        • RateLimit.Severity
        • UsePIDFromSystem
        • UseSysTimeStamp
        • CreatePath
        • Socket
        • HostName
        • Annotate
        • ParseTrusted
        • Unlink
        • UseSpecialParser
        • ParseHostname
    • Parser Modules
      • pmciscoios
      • pmdb2diag: DB2 Diag file parser module
      • pmlastmsg: last message repeated n times
      • Log Message Normalization Parser Module (pmnormalize)
      • pmnull: Syslog Null Parser Module
      • pmrfc3164: Parse RFC3164-formatted messages
        • permit.squareBracketsInHostname
        • permit.slashesInHostname
        • permit.AtSignsInHostname
        • force.tagEndingByColon
        • remove.msgFirstSpace
        • detect.YearAfterTimestamp
        • detect.headerless
        • headerless.hostname
        • headerless.tag
        • headerless.ruleset
        • headerless.errorfile
        • headerless.drop
      • pmrfc3164sd: Parse RFC5424 structured data inside RFC3164 messages
      • pmrfc5424: Parse RFC5424-formatted messages
    • Message Modification Modules
      • AI-based classification (mmaitag)
      • IP Address Anonymization Module (mmanon)
      • mmcount
      • Darwin connector (mmdarwin)
      • MaxMind/GeoIP DB lookup (mmdblookup)
      • Support module for external message modification modules
      • Fields Extraction Module (mmfields)
      • JSON/CEE Structured Content Extraction Module (mmjsonparse)
      • Kubernetes Metadata Module (mmkubernetes)
      • Log Message Normalization Module (mmnormalize)
      • RFC5424 structured data parsing module (mmpstrucdata)
      • mmrfc5424addhmac
      • mmrm1stspace: First Space Modification Module
      • Number generator and counter module (mmsequence)
      • mmsnmptrapd message modification module
      • mmtaghostname: message modification module
      • Fix invalid UTF-8 Sequences (mmutf8fix)
    • String Generator Modules
    • Library Modules
    • Templates
      • List template type
      • Subtree template type
      • String template type
      • Plugin template type
      • Constant statement
      • Property statement
      • Template options
      • Template examples
      • Reserved template names
      • Legacy $template statement
    • rsyslog Properties
    • The Property Replacer
      • Property Replacer nomatch mode
    • Filter Conditions
    • RainerScript
      • Data Types
      • Expressions
      • Functions
        • Built-in Functions
          • cnum()
          • cstr()
          • dyn_inc()
          • exec_template()
          • exists()
          • field()
          • format_time()
          • get_property()
          • getenv()
          • int2hex()
          • num2ipv4() / ipv42num()
          • is_time()
          • lookup()
          • parse_json()
          • parse_time()
          • percentile_observe()
          • previous_action_suspended()
          • prifilt()
          • random()
          • re_extract()
          • re_extract_i()
          • re_match()
          • re_match_i()
          • replace()
          • script_error()
          • strlen()
          • substring()
          • tolower()
          • ltrim() / rtrim()
          • wrap()
        • Module Functions
          • Faup
          • HashXX
          • HashXXmod
          • HTTP-Request
          • Unflatten
      • Control Structures
      • configuration objects
      • Rsyslog Parameter String Constants
      • Examples
      • Variable (Property) types
      • Lookup Tables
      • General Queue Parameters
      • The rsyslog “call” statement
      • The rsyslog “call_indirect” statement
      • global() configuration object
      • The rsyslog include() object
    • Actions
    • Input
    • Parser
    • timezone
    • Examples
    • Legacy Configuration Directives
      • Configuration Parameter Types
      • Legacy Global Configuration Statements
        • $AbortOnUncleanConfig
        • $DebugPrintCFSyslineHandlerList
        • $DebugPrintModuleList
        • $DebugPrintTemplateList
        • $FailOnChownFailure
        • $GenerateConfigGraph
        • $IncludeConfig
        • $MainMsgQueueSize
        • $MaxOpenFiles
        • $ModDir
        • $ModLoad
        • $UMASK
        • $ResetConfigVariables
      • Legacy Directives affecting Input Modules
        • $AllowedSender
        • $DropMsgsWithMaliciousDnsPTRRecords
        • $ControlCharacterEscapePrefix
        • $DropTrailingLFOnReception
        • $Escape8BitCharactersOnReceive
        • $EscapeControlCharactersOnReceive
        • $MarkMessagePeriod
      • Depricated Legacy Action-Specific Configuration Statements
        • How to Convert Deprecated $ActionExecOnlyWhenPreviousIsSuspended to Modern Style
        • How to Convert Deprecated $ActionResumeInterval to Modern Style
        • $RepeatedMsgReduction
        • $omfileForceChown
        • $DirGroup
        • How to Convert Deprecated $DirOwner to Modern Style
        • $DynaFileCacheSize
        • $FileCreateMode
        • $FileGroup
        • $FileOwner
        • $GssForwardServiceName
        • $GssMode
      • Ruleset-Specific Legacy Configuration Statements
        • $RulesetCreateMainQueue
        • $RulesetParser
    • rsyslog statistic counter
    • Modules
      • Where are the modules integrated into the Message Flow?
    • Output Channels
    • Dropping privileges in rsyslog
    • Notes on IPv6 Handling in Rsyslog
    • libgcrypt Log Crypto Provider (gcry)
    • libossl Log Crypto Provider (ossl)
    • Dynamic Stats
    • Lookup Tables
    • Percentile Stats
    • Converting older formats to advanced
    • Configuration Formats
    • sysklogd format
  • FAQ
    • FAQ: some general topics often asked
    • What is the difference between the main_queue and a queue with a ruleset tied to an input?
    • FAQ: Encrypting MySQL Traffic with ommysql Plugin
    • FAQ: Troubleshooting UDP Packet Loss
    • Common Configuration Mistakes and Misunderstandings
  • Tutorials
    • Encrypting Syslog Traffic with TLS (SSL)
      • Sample Use Case: Single Central Log Server
      • Setting up the CA
      • Generating the machine certificate
      • Setting up the Central Server
      • Setting up a client
      • Setting up the UDP syslog relay
      • Error Messages
      • Creating certificates with a script
    • Encrypting Syslog Traffic with TLS (SSL) [short version]
    • Writing syslog messages to MariaDB, MySQL, PostgreSQL or any other supported Database
    • Handling a massive syslog database insert rate with Rsyslog
    • Reliable Forwarding of syslog Messages with Rsyslog
    • Recording the Priority of Syslog Messages
    • Failover Syslog Server
    • Log rotation with rsyslog
    • GELF forwarding in rsyslog
    • Log Sampling
    • Random sampling
    • Hash-based Sampling
  • Troubleshooting
    • Output File is not Being Written
    • Troubleshooting SELinux-Related Issues
    • Rsyslog Debug Support
    • troubleshooting problems
    • How to create a debug log
  • Concepts
    • Understanding rsyslog Queues
    • The Janitor Process
    • Message parsers in rsyslog
    • Multiple Rulesets in rsyslog
    • NetStream Drivers
      • ptcp Network Stream Driver
      • gtls Network Stream Driver
      • Supported Driver Modes
      • Supported Authentication Modes
      • CheckExtendedKeyPurpose
      • PrioritizeSAN
      • openssl Network Stream Driver
  • Development
    • The rsyslog config data model
    • Objects
    • Debugging
    • Action Threads and Queue Engine (Developer-Oriented)
    • rsyslog code style
    • Writing Rsyslog Output Plugins
    • The rsyslog queue object
    • writing rsyslog tests
    • Documentation Reference Section Structure Guidelines
    • Documentation Style Guide
    • Generic design of a syslogd
    • Internal tooling
  • Reference
    • Rsyslog Containers
      • User-Focused Images
        • rsyslog/rsyslog-minimal
        • rsyslog/rsyslog
        • rsyslog/rsyslog-collector
        • rsyslog/rsyslog-dockerlogs
      • Development and Historical Images
    • Installation
      • Installing rsyslog from Package
      • Using Rsyslog Docker Containers
      • Installing rsyslog from Source
      • Installing rsyslog from the source repository
    • Historical Documents
      • Using php-syslog-ng with rsyslog
      • Legacy Format Samples for Multiple Rulesets
      • Developing rsyslog modules (outdated)
      • Receiving massive amounts of messages with high performance
      • Compatibility Notes for rsyslog v8
      • Compatibility Notes for rsyslog v7
      • Compatibility Notes for rsyslog v6
      • Compatibility Notes for rsyslog v5
      • Compatibility Notes for rsyslog v4
      • Compatibility Notes for rsyslog v3
    • RSyslog - History
    • Licensing
    • How you can Help
    • Community Resources
    • RSyslog - Features
    • Proposals
      • Version Naming
    • Rsyslog Whitepapers
      • syslog parsing in rsyslog
      • syslog-protocol support in rsyslog
      • Turning Lanes and Rsyslog Queues
      • Preserving syslog sender over NAT
      • How reliable should reliable logging be?
Back to top
View this page

pmrfc5424: Parse RFC5424-formatted messages¶

This is the new Syslog Standard.

RFC 5424

Support: rsyslog Assistant | GitHub Discussions | GitHub Issues: rsyslog source project

Contributing: Source & docs: rsyslog source project

© 2008–2025 Rainer Gerhards and others. Licensed under the Apache License 2.0.

Next
Message Modification Modules
Previous
pmrfc3164sd: Parse RFC5424 structured data inside RFC3164 messages
Made with Furo