RFC 6587
Transmission of Syslog Messages over TCP
Transmission of Syslog Messages over TCP 🎀
Okay bestie, this is RFC 6587 💖 It came from the IETF (Internet Engineering Task Force) and was published in April 2012. It's classed as Historic 🦋, so it's kept for the record rather than as a Standards Track spec. The authors are R. Gerhards from Adiscon GmbH and C. Lonvick from Cisco Systems, Inc. ✨ The ISSN is 2070-1721. The title block doesn't list anything it obsoletes or updates, so nothing to flag there 💅
Abstract ✨
Legacy syslog over TCP has been around for ages with loads of implementations and deployments 🌸 It evolved without ever getting standardized, but it's been pretty interoperable in the real world, which is honestly iconic. This memo describes how TCP has been used as a transport for syslog messages 💜
Status of This Memo 🧚
So this document is not an Internet Standards Track specification. It's published for the historical record 📜
It's a Historic Document for the Internet community. It's a product of the Internet Engineering Task Force (IETF) and represents the consensus of the IETF community. It got public review and was approved for publication by the Internet Engineering Steering Group (IESG). Not every document the IESG approves is a candidate for any level of Internet Standard, so see Section 2 of RFC 5741 🙈
Info about the current status, any errata, and how to give feedback is at http://www.rfc-editor.org/info/rfc6587.
IESG Note ⚠️
The IESG does not recommend implementing or deploying syslog over plain tcp, which is described in this document, because it lacks the ability to enable strong security [RFC3365]. Main character energy, but in a sad way 😭
Implementing the TLS transport [RFC5425] is recommended so that appropriate security features are available to operators who want to deploy secure syslog. Similarly, those security features can be turned off for those who don't want them 🫶
Copyright Notice ©
Copyright (c) 2012 IETF Trust and the persons identified as the document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, since they describe your rights and restrictions with respect to this document. Code Components extracted from this document need to include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions, and they come without warranty as described in the Simplified BSD License 📝
Table of Contents 📚
1. Introduction ....................................................3
2. Conventions Used in This Document ...............................5
3. Message Transmission ............................................5
3.1. Character Encoding Scheme ..................................5
3.2. Session ....................................................6
3.3. Session Initiation .........................................6
3.4. Message Transfer ...........................................6
3.4.1. Octet Counting ......................................7
3.4.2. Non-Transparent-Framing .............................7
3.4.3. Method Change .......................................8
3.5. Session Closure ............................................8
4. Applicability Statement .........................................8
5. Security Considerations .........................................9
6. Acknowledgments .................................................9
7. References .....................................................10
7.1. Normative References ......................................10
7.2. Informative References ....................................101. Introduction 💖
The Standards-Track documents in the syslog series recommend using the syslog protocol [RFC5424] with the TLS transport [RFC5425] for all event messages. The authors of this document totally back that position 🙌 They only wrote this document to describe what's been observed with legacy syslog over TCP, which still seems to be widely used.
Two primary format options have been observed with legacy syslog being transported over TCP. These have been called "non-transparent-framing" and "octet-counting". The non-transparent-framing mechanism has some inherent problems 💀
Diagram 1 shows how all of these syslog transports relate to each other. There are three originators, labeled A, B, and C, plus one collector. Originator A uses the TCP transport described in this document. Originator B uses the UDP transport, which is described in [RFC5426]. Originator C uses the TLS transport, which is described in [RFC5425]. The collector is shown with the ability to accept all three transports 🦋
+---------------------+
| Originator A |
|---------------------|
| syslog application |
| |
|---------------------|
| syslog transport |
| TCP |
|---------------------|
v
|
/ +---------------------+
/ | Originator B |
/ |---------------------|
/ +----------------------+ | syslog application |
/ | Collector | | |
| |----------------------| |---------------------|
| | syslog application | | syslog transport |
| | | | UDP |
| |----------------------| |---------------------|
| | syslog transport | v
| | TCP | TLS | UDP | |
| |----------------------| |
| ^ ^ ^ |
| | | | |
\ / | \ /
--------- | ------------------
|
|
| +---------------------+
| | Originator C |
| |---------------------|
| | syslog application |
| | |
| |---------------------|
| | syslog transport |
| | TLS |
| |---------------------|
| v
\ /
---------------
Diagram 1. Syslog Layers2. Conventions Used in This Document 📖
The terminology defined in Section 3 of [RFC5424] is used all through this spec, so you'll want to be familiar with it before diving in 🤓
This document also talks about devices that use the syslog message format described in [RFC3164]. Devices that keep using that message format (no matter the transport) get called "legacy syslog devices". Devices that use the message format described in [RFC5424] get called "standardized syslog devices" ✨
3. Message Transmission 💌
Syslog is simplex in nature 📨 It's been observed that implementations of syslog over TCP also don't use any back-channel to send info back to the transport sender. So they don't use any application-level acknowledgement for syslog signaling from receiver to sender. Message receipt acknowledgement, reliability, and flow control all come from TCP's own capabilities 💅
3.1. Character Encoding Scheme 🔤
Syslog over TCP messages don't say which coded character set (e.g., [US-ASCII] or [UNICODE] ) or character encoding scheme (e.g., so-called "7-bit ASCII" or UTF-8 [RFC3629]) they're using. The usual approach has been to only include characters from the ASCII repertoire (i.e., %d32 to %d126 inclusive) using the "Network Virtual Terminal" (NVT) encoding [RFC5198] 🌈
The message header usually has only ASCII characters, in NVT encoding. This has been seen even when a different encoding (e.g., UTF-8) was used for the MSG part. However, characters outside the ASCII range have shown up inside the header too. When that happens, some syslog applications have had trouble processing those messages 😬
It's also been observed that receivers often transform characters outside the ASCII range in an effort to "escape control characters". Some receiver implementations just drop those characters. This is considered a poor practice, because it causes problems with coded character sets other than ASCII and with character encodings other than NVT, most notably the UTF-8 encoding of Unicode 🙅♀️
Relays forward messages using the character encoding schemes of the messages they receive. If two different senders use different character encoding schemes, the relay forwards each message to a collector in that message's character encoding. So a collector has to be ready to receive messages from the same relay in different encodings 🧚
3.2. Session 🦋
Like most other protocols, the syslog transport sender is the TCP host that starts the TCP session. After that, messages get sent from the transport sender to the transport receiver. No application-level data goes from the transport receiver back to the transport sender. The roles of transport sender and receiver seem to stay fixed once the session is established 🔒
When it's been observed, if an error happens that TCP can't fix, the host that detected the error gracefully closes the TCP session. No application-level messages have been seen that tell the other host about the state of the host's syslog application 🤐
3.3. Session Initiation 🚪
The TCP host acting as a syslog transport receiver listens on a TCP port. The TCP transport sender starts a TCP session to the syslog transport receiver as specified in [RFC0793] 💜
This protocol has no standardized port assignment. In practice, network admins usually pick something they feel won't clash with anything else active on their networks. The most common picks have been either TCP/514, which is actually allocated to another protocol, or some variant of adding 514 to a multiple of 1000 🍓 For more info, see Section 4 (that's next part, bestie!).
3.4. Message Transfer 📬
Syslog over TCP has been around for a number of years. Just like legacy syslog over UDP, different implementations exist. The older method, non-transparent-framing, has problems. The newer method, octet-counting, is reliable and hasn't been seen to cause the problems noted with non-transparent-framing ✨
With both methods, during the message transfer phase, the syslog transport sender sends a stream of messages to the transport receiver. They're sent in sequence, and one message is encapsulated inside each TCP frame. Either TCP host can start session closure at any time, as specified in Section 3.5 of [RFC0793]. In practice, this often happens after a long stretch of inactivity 😴
Part 2 is coming next, bestie, with Section 3.4.1 and everything after 🫶💖
3.4.1. Octet Counting ✨
okay so this framing lets you send every single character inside a syslog message 💅 and it's basically the same vibe as the method in [RFC5425]. The transport receiver uses the defined message length to figure out where one syslog message ends 🎀. As [RFC3164] points out, the upper limit for a legacy syslog message length is 1024 octets. Standardized syslog has expanded that limit 🦋
It can be assumed that octet-counting framing is used if a syslog frame starts with a digit 🔢
All syslog messages can be considered to be TCP "data" per the Transmission Control Protocol [RFC0793] 🧚 The syslog message stream has this ABNF [RFC5234] definition:
TCP-DATA = *SYSLOG-FRAME
SYSLOG-FRAME = MSG-LEN SP SYSLOG-MSG ; Octet-counting
; method
MSG-LEN = NONZERO-DIGIT *DIGIT
NONZERO-DIGIT = %d49-57
SYSLOG-MSG is defined in the syslog protocol [RFC5424] and may
also be considered to be the payload in [RFC3164]MSG-LEN is the octet count of the SYSLOG-MSG in the SYSLOG-FRAME 💜
3.4.2. Non-Transparent-Framing 🌸
The non-transparent-framing method puts a syslog message inside a frame and ends it with a TRAILER character 🍓 The TRAILER has usually been a single character, and most often it's ASCII LF (%d10). However, other characters have also been seen, with ASCII NUL (%d00) being a prominent example. Some devices have also been seen to emit a two-character TRAILER, which is usually CR and LF 🙈
The problem with non-transparent-framing comes from the use of a TRAILER character 😭 The traditional TRAILER character is not escaped within the message, which causes problems for the receiver.
For example, a message in the style of [RFC3164] containing one or more LF characters may be misinterpreted as multiple messages by the receiving syslog application 💀
The ABNF for this is shown here:
TCP-DATA = *SYSLOG-FRAME
SYSLOG-FRAME = SYSLOG-MSG TRAILER ; non-transparent-framing
; method
TRAILER = LF / APP-DEFINED
APP-DEFINED = 1*2OCTET
SYSLOG-MSG is defined in the syslog protocol [RFC5424] and may
also be considered to be the payload in [RFC3164]A transport receiver can assume that non-transparent-framing is used if a syslog frame starts with the ASCII character "<" (%d60) 🦋
3.4.3. Method Change 🌈
In legacy implementations, it has been observed that the framing may change on a frame-by-frame basis. This is probably not a good idea, but it's been seen 🙃
3.5. Session Closure 🎀
The syslog session is closed when one of the TCP hosts decides to do so. It then initiates a local TCP session closure. Following TCP [RFC0793], it doesn't need to notify the remote TCP host of its intention to close the session, nor does it accept any messages that are still in transit 👋
4. Applicability Statement 🔮
Again, it must be emphasized that the Standards-Track documents in the syslog series recommend using the TLS transport [RFC5425] to transport syslog messages. This document does not recommend that new implementations or deployments use syslog over TCP, except for the explicit purpose of interoperating with existing deployments 🫶
One of the major problems with interoperability with this protocol is that there is no consistent TCP port assigned 😩 Most of the successful implementations have made the selection of a port a user-configurable option. The most frequently observed port for this has been TCP/514, which is actually assigned to the Shell protocol 🐚
Operators must carefully select which port to use in their deployment and be prepared to encounter different default port assignments in implementations 🧐
There are several advantages to using TCP: flow control, error recovery, and reliability, to name a few ✨ These reasons, and the ease of programming, have led people to use this transmission protocol to transmit syslog 💖
One potential disadvantage is the buffering mechanism used by TCP. Ordinarily, TCP decides when enough data has been received from the application to form a segment for transmission. This may be adjusted through timers, but still, some application data may wait in a buffer for a relatively long time 🥲 Syslog data is not normally time-sensitive, but if this delay is a concern, the syslog transport sender may utilize the PUSH Flag as described in [RFC0793] to have the sending TCP immediately send all buffered data 🚀
5. Security Considerations 🔒
This protocol makes no meaningful provisions for security. It lacks authentication, integrity checking, and privacy. It makes no provision for flow control or end-to-end confirmation of receipt, relying instead on the underlying TCP implementations to approximate these functions. It should not be used if deployment of [RFC5425] on the systems in question is feasible. 🚨💀
6. Acknowledgments 👑
The authors wish to thank David Harrington, Tom Petch, Richard Graveman, and all other people who commented on various versions of this proposal. We would also like to thank Peter Saint-Andre for clarifying character encodings 🫶
The authors would also like to thank Randy Presuhn for being our reviewer and document shepherd, and a special thanks to Dan Romascanu for his support and guidance 🥹
7. References 📚
7.1. Normative References
[RFC0793] Postel, J., "Transmission Control Protocol", STD 7,
RFC 793, September 1981.
[RFC3365] Schiller, J., "Strong Security Requirements for Internet
Engineering Task Force Standard Protocols", BCP 61,
RFC 3365, August 2002.
[RFC5198] Klensin, J. and M. Padlipsky, "Unicode Format for Network
Interchange", RFC 5198, March 2008.
[RFC5234] Crocker, D. and P. Overell, "Augmented BNF for Syntax
Specifications: ABNF", STD 68, RFC 5234, January 2008.
[RFC5424] Gerhards, R., "The Syslog Protocol", RFC 5424,
March 2009.
[RFC5425] Miao, F., Ma, Y., and J. Salowey, "Transport Layer
Security (TLS) Transport Mapping for Syslog", RFC 5425,
March 2009.
[US-ASCII] ANSI, "Coded Character Set -- 7-bit American Standard
Code for Information Interchange, ANSI X3.4-1986", 1986.7.2. Informative References
[RFC3164] Lonvick, C., "The BSD Syslog Protocol", RFC 3164,
August 2001.
[RFC3629] Yergeau, F., "UTF-8, a transformation format of ISO
10646", STD 63, RFC 3629, November 2003.
[RFC5426] Okmianski, A., "Transmission of Syslog Messages over
UDP", RFC 5426, March 2009.
[UNICODE] The Unicode Consortium. The Unicode Standard, Version
6.0.0, (Mountain View, CA: The Unicode Consortium,
2011. ISBN 978-1-936213-01-6),
<http://www.unicode.org/versions/Unicode6.0.0/>.Authors' Addresses 💌
Rainer Gerhards
Adiscon GmbH
Mozartstrasse 21
Grossrinderfeld, BW 97950
Germany
EMail: rgerhards@adiscon.com
Chris Lonvick
Cisco Systems, Inc.
12515 Research Blvd.
Austin, TX 78759
USA
EMail: clonvick@cisco.com📦 where this page comes from
- ietf: rfc6587 2012-04
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms