Question 1

What syslog formats are supported?

Accepted Answer

The parser supports RFC 3164 (BSD syslog, the older format used by most Unix systems) and RFC 5424 (the modern structured syslog format). It auto-detects the format of each line, so you can paste a mix of both in the same input.

Question 2

How is the priority value decoded?

Accepted Answer

The priority value in angle brackets encodes both facility and severity. Facility = priority div 8; Severity = priority mod 8. For example, priority 34 means facility 4 (auth) and severity 2 (Critical). The tool displays human-readable names for both.

Question 3

What do the severity colour badges mean?

Accepted Answer

Emergency, Alert, and Critical are shown in red to indicate the most serious conditions. Error is orange. Warning is yellow. Notice and Info are blue. Debug is grey. These colours match common syslog viewer conventions.

Question 4

Can I export the parsed events?

Accepted Answer

Yes. Click the Copy as JSON button to copy the full array of parsed event objects to your clipboard. Each object contains all extracted fields: priority, facility, severity, timestamp, hostname, appName, pid, msgId, and message.

Question 5

What happens to lines that fail to parse?

Accepted Answer

Lines that do not match either RFC 3164 or RFC 5424 patterns are counted as failed and excluded from the table. The stats bar shows how many events were successfully parsed and how many failed, so you can identify problematic input.

Syslog Event Parser

Frequently Asked Questions