[RESOLVED] Benefits of RFC 5424 logs with external log server?

[logan5247]

I have my Graylog extractors working perfectly for the old RFC 3164 log format. I used this page to create them.

What are the benefits of switching to RFC 5424 logs if I’m using an external log server? I don't read the logs on the pfSense device itself, so the clog dependency wasn't an issue. So far, the only differences I can see are:

• More accurate timestamps (milliseconds)
• Sends hostname in log
• Structured data separated by equals sign (=) instead of comma-separated values (CSV)
• Longer messages (RFC 3164 was limited to 1024 bytes)

[jimp]

The points you mentioned are the benefits, primarily. Some people need that extra data/different format.

[logan5247]

@jimp Thanks!

One more thing. If I switch to RFC 5424, is there a page similar to this that explains the different values?

[jimp]

The content the message doesn't change, so nothing on that page is different.

[jimp]

Also those docs you linked are not an official source of documentation and are out of date. Always use https://docs.netgate.com/

[logan5247]

@jimp Thanks and thanks!