# The structure of a log message

The following sections describe the structure of log messages. Currently there are two standard syslog message formats:

  * The old standard described in RFC 3164 (also called the BSD-syslog or the legacy-syslog protocol): see [BSD-syslog or legacy-syslog messages](../../docs/axosyslog-core/4.26/chapter-concepts/concepts-message-structure/concepts-message-bsdsyslog/index.md)

  * The new standard described in RFC 5424 (also called the IETF-syslog protocol): see [IETF-syslog messages](../../docs/axosyslog-core/4.26/chapter-concepts/concepts-message-structure/concepts-message-ietfsyslog/index.md)

  * The Enterprise-wide message model or EWMM allows you to deliver structured messages between AxoSyslog nodes: see [Enterprise-wide message model (EWMM)](../../docs/axosyslog-core/4.26/chapter-concepts/concepts-message-structure/syslog-ng-message-format/index.md)

  * How messages are represented in AxoSyslog: see [Message representation in AxoSylog](../../docs/axosyslog-core/4.26/chapter-concepts/concepts-message-representation/index.md).




## Example messages on the wire

The same event in each format, to illustrate how the standards differ:

BSD-syslog (RFC 3164) — the `<PRI>` is followed directly by a legacy `Mmm dd hh:mm:ss` timestamp, the host, and the message:

Terminal window
```
    <34>Oct 11 22:14:15 mymachine su: 'su root' failed for lonvick on /dev/pts/8
```

IETF-syslog (RFC 5424) — the `<PRI>` is followed by a version digit and an ISO 8601 timestamp, then the structured header fields:

Terminal window
```
    <34>1 2026-10-11T22:14:15+00:00 mymachine su - - - 'su root' failed for lonvick on /dev/pts/8
```

EWMM — an RFC 5424 frame with `@syslog-ng` as the program and the message carried as JSON:

Terminal window
```
    <34>1 2026-10-11T22:14:15+00:00 mymachine @syslog-ng - - - {"PROGRAM":"su","MESSAGE":"'su root' failed for lonvick on /dev/pts/8","HOST":"mymachine","._TAGS":[".source.s_network"]}
```

* * *

[BSD-syslog or legacy-syslog messages](../../docs/axosyslog-core/4.26/chapter-concepts/concepts-message-structure/concepts-message-bsdsyslog/index.md)

[IETF-syslog messages](../../docs/axosyslog-core/4.26/chapter-concepts/concepts-message-structure/concepts-message-ietfsyslog/index.md)

[Enterprise-wide message model (EWMM)](../../docs/axosyslog-core/4.26/chapter-concepts/concepts-message-structure/syslog-ng-message-format/index.md)

[The PRI message part](../../docs/axosyslog-core/4.26/chapter-concepts/concepts-message-structure/concepts-message-pri/index.md)

Last modified July 24, 2026: [Reframe the wire examples around illustrating the differences (ea0a748e)](<https://github.com/axoflow/axosyslog-core-docs/commit/ea0a748e26955dd8df74d7a7745cda5834f8cd37>)