Enabling RFC 5424 for Enhanced Syslog Messages

Enabling RFC 5424 enhances syslog message format to include additional details.
Note: If "logging cli-command" configuration is present in the running configuration, it is not possible to switch between the default RFC 3164 syslog format and RFC 5424-compliant syslog format.
Note: The logging buffer must be cleared before you enable RFC 5424 logging; otherwise, the system displays an error.

With RFC 5424 enabled, syslog messages include details such as a more detailed timestamp, structured data, the hostname (potentially including the domain name), and the syslog sequence ID.

The following message shows a syslog message formatted according to the default RFC 3164 standards..

Oct 11 04:33:04:I:Security: Security: user test added by cli from CONSOLE session.  
by cli user from console session

The following message shows the same syslog message when RFC 5424 is enabled.

2023-10-10T20:41:05Z:I: george ICX7650_Router - Security [meta sequenceId=1] BOM Security: 
Security: user test modified by cli from CONSOLE session.  by cli user from console session

Refer to Generating Syslog Messages in RFC 5424 Format for more specific information on message contents.

Note: Items such as the domain name and hostname must be configured to be displayed in the RFC 5424 syslog messages.

Perform the following steps to enable enhanced syslog messages that follow RFC 5424 format.

  1. Enter global configuration mode.
    device# configure terminal
device(config)#
  2. Enable RFC 5424 logging.
    device(config)# logging enable rfc5424
  3. (Optional) If not already configured, configure the hostname for the ICX device.
    device(config)# hostname device
  4. (Optional) Enter the ip dns domain-list command followed by the fully qualified domain name (FQDN) of the ICX device to include the FQDN in syslog messages.
    device(config)# ip dns domain-list ruckuswireless.com

The following example produces the hostname and domain name combination ruckuswireless.com device in RFC 5424-format syslog messages.

device# configure terminal
device(config)# hostname device
device(config)# logging enable rfc5424
device(config)# ip dns domain-list ruckuswireless.com
Parent topic: Generating Syslog Messages in RFC 5424 Format