Syslog parser & viewer

Guide

What a syslog parser actually does

A raw syslog line is a single dense string with no obvious boundaries. A parser’s job is to recover the structure the sender encoded into it: the priority value, the header fields, any structured data, and the human-readable message. Once those parts are separated you can filter on severity, group by host, route by facility, or forward only what matters. The tool above does this on whatever you paste and colour-codes the severity using the same eight-level scale the rest of the site uses.

The fields, one by one

Priority (PRI)

Every well-formed message opens with a priority in angle brackets, such as <34>. It encodes two numbers at once. The facility is PRI ÷ 8 and identifies the subsystem that produced the message; the severity is PRI mod 8 and says how urgent it is. So <34> is facility 4 (auth) and severity 2 (critical). To go between a priority value and its parts in either direction, use the PRI calculator.

Header

After the priority comes the header. In RFC 5424 it is a fixed, space-separated sequence: a version digit, an ISO 8601 timestamp, the hostname, the app-name, the process ID, and a message ID. In RFC 3164 the header is looser — a non-year timestamp like Oct 11 22:14:15, the hostname, and a tag such as sshd[1234] that the parser splits into an application name and a process ID.

Structured data and message

RFC 5424 adds an optional structured data block — one or more bracketed elements like [exampleSDID@32473 iut="3"] carrying typed key/value pairs. Everything after that is the free-form message. The parser renders structured data as a readable list of parameters; for the full grammar see the RFC 5424 reference.

Viewing syslog on Linux

Most people reach for a parser because they are staring at a log file. Where that file lives depends on the distribution:

• Debian / Ubuntu: /var/log/syslog holds general system messages; authentication events go to /var/log/auth.log.
• RHEL / CentOS / Fedora: the equivalent is /var/log/messages, with security events in /var/log/secure.
• systemd hosts: the journal is the source of truth. Use journalctl -f to follow it, or journalctl -o short-iso for timestamps that look like RFC 5424.

To watch messages arrive in real time, tail -f /var/log/syslog is the classic move; pipe it through grep to narrow to one host or daemon. Copy any line that interests you and drop it into the parser to see its fields broken out.

Parsing syslog in code

For one-off inspection the tool above is enough, but in a pipeline you will want to parse programmatically. A few pointers:

• Prefer a real grammar over a single regex. RFC 5424 structured data can contain escaped brackets and quotes inside parameter values, which a naive regex will mis-split. Consume the bracketed elements with a small scanner instead.
• Python: the standard logging.handlers.SyslogHandler emits syslog, and libraries such as syslog-rfc5424-parser read it back. For quick work, split on the first few spaces after the PRI and parse the timestamp with datetime.fromisoformat.
• Pipelines: Logstash, Fluentd, and Vector all ship syslog parsers; feed them the raw line and they emit structured events. When the destination is a SIEM, the JSON and CEF converter shows the shape you are aiming for.