Transmission of Syslog Messages over UDP
RFC 5426

Network Working Group                                       A. Okmianski
Request for Comments: 5426                           Cisco Systems, Inc.
Category: Standards Track                                     March 2009

                Transmission of Syslog Messages over UDP

Status of This Memo

   This document specifies an Internet standards track protocol for the
   Internet community, and requests discussion and suggestions for
   improvements.  Please refer to the current edition of the "Internet
   Official Protocol Standards" (STD 1) for the standardization state
   and status of this protocol.  Distribution of this memo is unlimited.

Copyright Notice

   Copyright (c) 2009 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents in effect on the date of
   publication of this document (http://trustee.ietf.org/license-info).
   Please review these documents carefully, as they describe your rights
   and restrictions with respect to this document.

   This document may contain material from IETF Documents or IETF
   Contributions published or made publicly available before November
   10, 2008.  The person(s) controlling the copyright in some of this
   material may not have granted the IETF Trust the right to allow
   modifications of such material outside the IETF Standards Process.
   Without obtaining an adequate license from the person(s) controlling
   the copyright in such materials, this document may not be modified
   outside the IETF Standards Process, and derivative works of it may
   not be created outside the IETF Standards Process, except to format
   it for publication as an RFC or to translate it into languages other
   than English.

Abstract

   This document describes the transport for syslog messages over UDP/
   IPv4 or UDP/IPv6.  The syslog protocol layered architecture provides
   for support of any number of transport mappings.  However, for
   interoperability purposes, syslog protocol implementers are required
   to support this transport mapping.

Okmianski                   Standards Track                     [Page 1]
RFC 5426                  Syslog UDP Transport                March 2009

Table of Contents

   1. Introduction ....................................................2
   2. Conventions Used in This Document ...............................3
   3. Transport Protocol ..............................................3
      3.1. One Message Per Datagram ...................................3
      3.2. Message Size ...............................................3
      3.3. Source and Target Ports ....................................4
      3.4. Source IP Address ..........................................4
      3.5. UDP/IP Structure ...........................................4
      3.6. UDP Checksums ..............................................4
   4. Reliability Considerations ......................................5
      4.1. Lost Datagrams .............................................5
      4.2. Message Corruption .........................................5
      4.3. Congestion Control .........................................5
      4.4. Sequenced Delivery .........................................5
   5. Security Considerations .........................................6
      5.1. Sender Authentication and Message Forgery ..................6
      5.2. Message Observation ........................................7
      5.3. Replaying ..................................................7
      5.4. Unreliable Delivery ........................................7
      5.5. Message Prioritization and Differentiation .................7
      5.6. Denial of Service ..........................................8
   6. IANA Considerations .............................................8
   7. Acknowledgements ................................................8
   8. References ......................................................8
      8.1. Normative References .......................................8
      8.2. Informative References .....................................9

1.  Introduction

   Informational RFC 3164 [8] describes the syslog protocol as it was
   observed in existing implementations.  It describes both the format
   of syslog messages and a UDP [1] transport.  Subsequently, a
   Standards-Track syslog protocol has been defined in RFC 5424 [2].

   RFC 5424 specifies a layered architecture that provides for support
   of any number of transport layer mappings for transmitting syslog
   messages.  This document describes the UDP transport mapping for the
   syslog protocol.

   The transport described in this document can be used for transmitting