| 5.3 |  | Monitoring with Logging and Syslog |
| 5.3.6 |  | Syslog message parts and codes |

| The full format of a syslog message seen on the wire has three discernable parts. The first part is called the PRI, the second part is the HEADER, and the third part is the MSG. The total length of the packet must be 1024 bytes or less. There is no minimum length of the syslog message although a syslog packet with no contents is worthless and should not be transmitted. Each part of a syslog message contains specific information:

- The PRI part contains the Facilities and Severities numerical codes.
- The HEADER part contains a timestamp and an indication of the hostname or IP address of the device.
- The MSG part contains some additional information about the process that generated the message, and the text of the message.

Syslog codes
The Facilities and Severities of the messages are numerically coded with decimal values. Some of the operating system daemons and processes have been assigned Facility values. Processes and daemons that have not been explicitly assigned a Facility may use any of the local-use Facilities or they may use the user-level Facility. The designated Facilities are shown in the Figure along with their numerical code values.

Each message Priority also has a decimal Severity level indicator. These are described along with their numerical values in Figure .