8.0

Table Of Contents
SEVERITY-STRING
Em/ Al / Cr / Er / Wa / No / In / Db (The 8 severity levels specified in RFC 5424 are abbreviated as
follows:
n Em - Emergency
n Al - Alert
n Cr - Critical
n Er - Error
n Wa - Warning
n No - Notice
n In - Informational
n Db - Debug
SEVERITY
SEVERITY-STRING PRI-STRING [LINE-MARKER]
PRIVAL
1*3DIGIT ; range 0 .. 191 (the MSG PRI; contains facility and severity values, ORed together)
PRI-STRING
( PRIVAL ) (The PRIVAL contains the bits from the message PRI. This allows one to see the Facility
of the message, as well as the severity bits themselves._
LINE-MARKER
+ (The LINE-MARKER is added to each subsequent line generated from a multi-line submission. It
identifies multiline submissions and prevents a log injection security attack.)
STRUCTURED-DATA
1*SD-ELEMENT
SD-ELEMENT
[ SD-ID *(SP SD-PARAM) ]
SD-PARAM
PARAM-NAME %d34 PARAM-VALUE %d34
SD-ID
SD-NAME
PARAM-NAME
SD-NAME
PARAM-VALUE
UTF-8-STRING ; characters '', '\' and ']' MUST be escaped.
SD-NAME
1*32PRINTUSASCII ; except '', SP, ']', %d34 ()
MSG
[STRUCTURED-DATA SP] UTF-8-STRING
Audit Records
ESXi audit records, with facility code 13, are compliant to both RFC 3164 and 5424 formats and
you find them in the structured data section. In the audit record, you also find event-based
traceability information when such data is available. Audit records are stored in a special format,
not a regular log file. You can access audit records locally by using the viewAudit program
and the Virtual Infrastructure Management functionality FetchAuditRecords. Do not read, use,
or edit an audit record storage file directly. Locally stored audit records comply with RFC 5424
transmission format where the HOSTNAME and MSGID are always NILVALUE.
ESXi Syslog Message Transmission Formats
ESXi 8.0 formats syslog messages in compliance with either RFC 3164 or RFC 5424.
The definition of the transmission formats for RFC 3164 and RFC 5424 is in Augmented Backus-
Naur Form (ABNF).
VMware ESXi Installation and Setup
VMware, Inc. 244