Im geting syslogs from multiple servers, and Im having trouble to understand some syslog logs, here is one example
<189>12593340: 16596512: Jul 6 20:31:09: %PARSER-5-CFGLOG_LOGGEDCMD: User:someuser logged command:no 1480the first number inside <> is the priority, but the two numbers after that: "12593340" and "16596512" I dont know what their are.
Does anyone knows what are those numbers? how many formats the syslog logs has?
1 Answer
There are two standard formats (IETF Syslog and the BSD Syslog recommended form), and... there are probably as many non-standard formats as there are manufacturers.
Yours is a non-standard format, and the only people who know what these two fields actually mean are the developers of the software which sent them.
If sent to a BSD Syslog daemon, the whole message would be parsed according to the section "Valid PRI but no TIMESTAMP", and the whole thing including the extra numeric fields would just become 'message text'.
After some googling, this looks like a Cisco IOS message format, which is documented as:
seq no: timestamp: %facility-severity-MNEMONIC:descriptionseq no: Stamps log messages with a sequence number only if the
service sequence-numbersglobal configuration command is configured.
So it's possible that "12593340" is the sequence # of this message starting from 1 when the router was last rebooted.
2
