I feel the pain. Everybody decides their appliance will emit "syslog", but they don't bother to look at either RFC (not even the very lax RFC3164) and just emit

I feel the pain. Everybody decides their appliance will emit "syslog", but they don't bother to look at either RFC (not even the very lax RFC3164) and just emit "log messages preceded by some sort of timestamp", as the article calls out: > But what makes things hell is the fact that too many vendors decided not to care about what is in the RFCs, they decided that “hey, putting a year there is just fine” even though the RFC says “no”, that they don’t really need to set a host in the header, and that they didn’t really need to implement anything new after their initial legacy stuff was created. It sounds like the author and I are doing similar work, so he knows my pain: if you make a product which can parse syslog, and somebody selects your product for parsing syslog, and they they feed it non-syslog logs from Company Y's product... it's now your problem, instead of Company Y's, even though you're perfectly capable of parsing syslog! Luckily, regular expressions and beer eventually get most things sorted out. :)