ESXi 8.0 formats syslog messages in compliance with either RFC 3164 or RFC 5424.
The definition of the transmission formats for RFC 3164 and RFC 5424 is in Augmented Backus-Naur Form (ABNF).
RFC 3164 Transmission Message Format
| Parameter | Value |
| SYSLOG-MSG | HEADER SP MSG |
| HEADER | PRI TIMESTAMP SP HOSTNAME SP APP-NAME [PROC-IDENTIFIER] ":" |
| PRI | "<" PRIVAL ">" |
| PRIVAL | 1*3DIGIT ; range 0 .. 191 (the MSG PRI; contains facility and severity values, ORed together) |
| APP-NAME | 1*32PRINTUSASCII |
| HOSTNAME | 1*255PRINTUSASCII |
| PROC-IDENTIFIER | "[" *DIGITS "]" ; the PID associated with APP-NAME |
| TIMESTAMP | FULL-DATE "T" UTC-TIME (Never set a TIME-OFFSET) |
| FULL-DATE | DATE-FULLYEAR "-" DATE-MONTH "-" DATE-MDAY |
| DATE-FULLYEAR | 4DIGIT |
| DATE-MONTH | 2DIGIT ; 01-12 |
| DATE-MDAY | 2DIGIT ; 01-28, 01-29, 01-30, 01-31 based on month/year |
| UTC-TIME | TIME-HOUR ":" TIME-MINUTE ":" TIME-SECOND [TIME-SECFRAC] "Z" |
| TIME-HOUR | 2DIGIT ; 00-23 |
| TIME-MINUTE | 2DIGIT ; 00-59 |
| TIME-SECOND | 2DIGIT ; 00-59 |
| TIME-SECFRAC | "." 1*6DIGIT |
| STRUCTURED-DATA | 1*SD-ELEMENT |
| SD-ELEMENT | "[" SD-ID *(SP SD-PARAM) "]" |
| SD-PARAM | PARAM-NAME "%d34 PARAM-VALUE %d34 |
| SD-ID | SD-NAME |
| PARAM-NAME | SD-NAME |
| PARAM-VALUE | UTF-8-STRING ; characters '"', '\' and ']' MUST be escaped. |
| SD-NAME | 1*32PRINTUSASCII ; except '', SP, ']', %d34 (") |
| MSG | [STRUCTURED-DATA SP] UTF-8-STRING |
RFC 5424 Transmission Message Format
| Parameter | Value |
| SYSLOG-MSG | HEADER SP STRUCTURED-DATA [SP MSG] |
| HEADER | PRI VERSION SP TIMESTAMP SP HOSTNAME SP APP-NAME SP PROCID SP MSGID |
| PRI | "<" PRIVAL ">" |
| PRIVAL | 1*3DIGIT ; range 0 .. 191; contains facility and severity data |
| VERSION | NONZERO-DIGIT 0*2DIGIT |
| HOSTNAME | 1*255PRINTUSASCII |
| APP-NAME | 1*48PRINTUSASCII |
| NILVALUE | '-' |
| PROCID | NILVALUE | *DIGITS ; the PID associated with APP-NAME |
| MSGID | NILVALUE |
| TIMESTAMP | FULL-DATE "T" UTC-TIME |
| FULL-DATE | DATE-FULLYEAR "-" DATE-MONTH "-" DATE-MDAY |
| DATE-FULLYEAR | 4DIGIT |
| DATE-MONTH | 2DIGIT ; 01-12 |
| DATE-MDAY | 2DIGIT ; 01-28, 01-29, 01-30, 01-31 based on month/year |
| UTC-TIME | TIME-HOUR ":" TIME-MINUTE ":" TIME-SECOND [TIME-SECFRAC] "Z" |
| TIME-HOUR | 2DIGIT ; 00-23 |
| TIME-MINUTE | 2DIGIT ; 00-59 |
| TIME-SECOND | 2DIGIT ; 00-59 |
| TIME-SECFRAC | "." 1*6DIGIT |
| STRUCTURED-DATA | NILVALUE / 1*SD-ELEMENT |
| SD-ELEMENT | "[" SD-ID *(SP SD-PARAM) "]" |
| SD-PARAM | PARAM-NAME " %d34 PARAM-VALUE %d34 |
| SD-ID | SD-NAME |
| PARAM-NAME | SD-NAME |
| PARAM-VALUE | UTF-8-STRING ; characters '"', '\' and ']' MUST be escaped. |
| SD-NAME | 1*32PRINTUSASCII ; except '', SP, ']', %d34 (") |
| MSG | MSG-UTF8 |
| MSG-UTF8 | BOM UTF-8-STRING |
| BOM | %xEF.BB.BF |
