---
title: "The structure of a log message"
url: "https://axoflow.com/docs/axosyslog-core/4.28/chapter-concepts/concepts-message-structure/"
last_modified: "2026-07-24T13:35:04+02:00"
---

> For the complete documentation index, see [llms.txt](https://axoflow.com/docs/axosyslog-core/4.28/llms.txt).

# The structure of a log message

The following sections describe the structure of log messages. Currently there are two standard syslog message formats:

- The old standard described in RFC 3164 (also called the BSD-syslog or the legacy-syslog protocol): see [BSD-syslog or legacy-syslog messages](https://axoflow.com/docs/axosyslog-core/4.28/chapter-concepts/concepts-message-structure/concepts-message-bsdsyslog/index.md)
- The new standard described in RFC 5424 (also called the IETF-syslog protocol): see [IETF-syslog messages](https://axoflow.com/docs/axosyslog-core/4.28/chapter-concepts/concepts-message-structure/concepts-message-ietfsyslog/index.md)
- The Enterprise-wide message model or EWMM allows you to deliver structured messages between AxoSyslog nodes: see [Enterprise-wide message model (EWMM)](https://axoflow.com/docs/axosyslog-core/4.28/chapter-concepts/concepts-message-structure/syslog-ng-message-format/index.md)
- How messages are represented in AxoSyslog: see [Message representation in AxoSyslog](https://axoflow.com/docs/axosyslog-core/4.28/chapter-concepts/concepts-message-representation/index.md).

## Example messages on the wire

The same event in each format, to illustrate how the standards differ:

BSD-syslog (RFC 3164) — the `<PRI>` is followed directly by a legacy `Mmm dd hh:mm:ss` timestamp, the host, and the message:

```shell
<34>Oct 11 22:14:15 mymachine su: 'su root' failed for lonvick on /dev/pts/8
```

IETF-syslog (RFC 5424) — the `<PRI>` is followed by a version digit and an ISO 8601 timestamp, then the structured header fields:

```shell
<34>1 2026-10-11T22:14:15+00:00 mymachine su - - - 'su root' failed for lonvick on /dev/pts/8
```

EWMM — an RFC 5424 frame with `@syslog-ng` as the program and the message carried as JSON:

```shell
<34>1 2026-10-11T22:14:15+00:00 mymachine @syslog-ng - - - {"PROGRAM":"su","MESSAGE":"'su root' failed for lonvick on /dev/pts/8","HOST":"mymachine","._TAGS":[".source.s_network"]}
```

---

[BSD-syslog or legacy-syslog messages](https://axoflow.com/docs/axosyslog-core/4.28/chapter-concepts/concepts-message-structure/concepts-message-bsdsyslog/index.md)

The structure of BSD-syslog (RFC 3164) messages: the PRI, HEADER, and MSG parts.

[IETF-syslog messages](https://axoflow.com/docs/axosyslog-core/4.28/chapter-concepts/concepts-message-structure/concepts-message-ietfsyslog/index.md)

[Enterprise-wide message model (EWMM)](https://axoflow.com/docs/axosyslog-core/4.28/chapter-concepts/concepts-message-structure/syslog-ng-message-format/index.md)

[The PRI message part](https://axoflow.com/docs/axosyslog-core/4.28/chapter-concepts/concepts-message-structure/concepts-message-pri/index.md)

How the PRI part of a syslog message encodes the facility and severity of the message.

Last modified July 24, 2026: [Reframe the wire examples around illustrating the differences (ea0a748e)](https://github.com/axoflow/axosyslog-core-docs/commit/ea0a748e26955dd8df74d7a7745cda5834f8cd37)