How is the Syslog Priority (PRI) value calculated?

PRI = (Facility Number × 8) + Severity Number. For example, local4 (Facility 20) with Warning severity (Severity 4) produces PRI = (20 × 8) + 4 = 164 ( ).

What is the default network port for Syslog?

Standard unencrypted syslog runs over UDP port 514. Secure syslog over TLS uses TCP port 6514 per RFC 5425.

Syslog Message Generator & RFC 5424 Parser

Construct and parse RFC 5424 / RFC 3164 syslog packets, calculating PRI priority codes across 24 facilities and 8 severities.

Facility (RFC 5424)

Severity Level

Hostname

App / Process Name

Log Payload / Message

📜 Constructed Syslog Packet (RFC 5424)

Protocol Breakdown & Priority Analysis RFC 5424 Compliant

Calculated PRI Code

<131> (Facility 16 × 8 + Severity 3)

Standard Format

RFC 5424 (ISO 8601 UTC Timestamp)

📊 SIEM Log Ingestion: Generating mock syslog messages tests log shippers (rsyslog, Fluentbit, Vector) and alert ingestion rules in Splunk, Elastic, and Datadog before critical incidents occur in production.

Syslog Protocol Architecture (RFC 5424 & RFC 3164)

Syslog is a client/server logging protocol used on Unix, Linux, routers, switches, and firewalls to forward diagnostic events across IP networks to a centralized log collector (SIEM).

Syslog Severity Levels Reference

Code	Severity	Description	Operational Impact
`0`	Emergency	System is unusable	P0: Immediate total outage
`1`	Alert	Action must be taken immediately	P1: Primary database mirror failed
`2`	Critical	Critical conditions	P2: Hardware disk failure
`3`	Error	Error conditions	Non-fatal application errors
`4`	Warning	Warning conditions	Disk space > 90%
`5`	Notice	Normal but significant	Service restarted normally
`6`	Informational	Informational messages	User login successful
`7`	Debug	Debug-level output	Detailed trace packets