Validate RFC 5424 Compliance for Logs Forwarded from Aria Operations for Logs to external syslog servers

Products

• VCF Operations

Issue/Introduction

Administrators wants to verify if syslog messages forwarded out of VMware Aria Operations for Logs to a third-party external syslog server comply with the RFC 5424 standard. If the forwarded logs do not meet the expected RFC 5424 structure, the destination SIEM or syslog collector may fail to parse the headers correctly, resulting in malformed or unindexed log data.

Environment

VMware Aria Operations for Logs 8.18.x

Resolution

Verify that the outbound message header strictly adheres to the following RFC 5424 format structure:

<PRI>VERSION TIMESTAMP HOSTNAME APP-NAME PROCID MSGID [STRUCTURED-DATA] MSG

For example:

The screenshot above shows a log event that complies with the RFC 5424 standard.

The following breakdown maps the log elements from the screenshot to the RFC 5424 header fields:

• <PRI>: <14>

• VERSION: 1

• TIMESTAMP: 2025-11-27T04:55:06.043930+00:00 

• HOSTNAME: [####]

• APP-NAME: vpxd

• PROCID: 5658

• MSGID: - (NILVALUE)

• STRUCTURED-DATA: - (NILVALUE)

• MSG: Event [1444382] [1-1]...