Syslog Messages — RFC 3164 (log)
A BSD-style syslog (RFC 3164) sample — timestamp, host, process and PID, then the message, across sshd, cron, kernel, nginx, and application entries. A fixture for testing syslog parsers and forwarders.
Jan 15 03:12:24 app-01 systemd[6496]: Started Session 42 of user deploy.
Jan 15 03:12:47 app-01 cron[6407]: (root) CMD (/usr/bin/backup.sh)
Jan 15 03:13:48 app-01 kernel[3752]: [UFW BLOCK] IN=eth0 OUT= SRC=192.0.2.55 DST=203.0.113.42 PROTO=TCP SPT=44321 DPT=22
Jan 15 03:15:09 app-01 dockerd[1534]: container 9f3c started (image=api:1.4.2)
Jan 15 03:15:38 app-01 postgres[7796]: checkpoint complete: wrote 128 buffers (0.8%)
Jan 15 03:16:11 app-01 systemd[8938]: Started Session 42 of user deploy.
Jan 15 03:17:37 app-01 nginx[6751]: worker process 2145 exited with code 0
Jan 15 03:18:10 app-01 sshd[5845]: Connection closed by 198.51.100.23 port 51234
Jan 15 03:19:38 app-01 app[705]: request completed method=GET path=/health status=200 duration=3ms
Jan 15 03:19:45 app-01 sshd[2996]: Accepted publickey for deploy from 203.0.113.7 port 54021 ssh2
Jan 15 03:20:02 app-01 nginx[5757]: worker process 2145 exited with code 0
Jan 15 03:20:36 app-01 sshd[7982]: Accepted publickey for deploy from 203.0.113.7 port 54021 ssh2
Jan 15 03:21:10 app-01 nginx[7287]: worker process 2145 exited with code 0
Jan 15 03:22:00 app-01 app[3471]: request completed method=GET path=/health status=200 duration=3ms
Jan 15 03:23:00 app-01 systemd[7013]: Started Session 42 of user deploy.
Jan 15 03:23:14 app-01 sshd[7655]: Accepted publickey for deploy from 203.0.113.7 port 54021 ssh2
Jan 15 03:23:17 app-01 sshd[8103]: Connection closed by 198.51.100.23 port 51234
Jan 15 03:24:13 app-01 dockerd[1616]: container 9f3c started (image=api:1.4.2)
Jan 15 03:25:38 app-01 kernel[5795]: [UFW BLOCK] IN=eth0 OUT= SRC=192.0.2.55 DST=203.0.113.42 PROTO=TCP SPT=44321 DPT=22
Jan 15 03:26:06 app-01 kernel[7510]: [UFW BLOCK] IN=eth0 OUT= SRC=192.0.2.55 DST=203.0.113.42 PROTO=TCP SPT=44321 DPT=22
Jan 15 03:26:41 app-01 nginx[5855]: worker process 2145 exited with code 0
Jan 15 03:28:09 app-01 app[6099]: request completed method=GET path=/health status=200 duration=3ms
Jan 15 03:29:17 app-01 dockerd[8028]: container 9f3c started (image=api:1.4.2)
Jan 15 03:30:15 app-01 kernel[518]: [UFW BLOCK] IN=eth0 OUT= SRC=192.0.2.55 DST=203.0.113.42 PROTO=TCP SPT=44321 DPT=22
Jan 15 03:30:24 app-01 sshd[2831]: Accepted publickey for deploy from 203.0.113.7 port 54021 ssh2
Jan 15 03:31:08 app-01 nginx[6109]: worker process 2145 exited with code 0
Jan 15 03:32:16 app-01 postgres[7108]: checkpoint complete: wrote 128 buffers (0.8%)
Jan 15 03:33:27 app-01 kernel[3635]: [UFW BLOCK] IN=eth0 OUT= SRC=192.0.2.55 DST=203.0.113.42 PROTO=TCP SPT=44321 DPT=22
Jan 15 03:33:34 app-01 kernel[1964]: [UFW BLOCK] IN=eth0 OUT= SRC=192.0.2.55 DST=203.0.113.42 PROTO=TCP SPT=44321 DPT=22
Jan 15 03:33:46 app-01 systemd[7442]: Started Session 42 of user deploy.
Jan 15 03:34:20 app-01 app[2605]: request completed method=GET path=/health status=200 duration=3ms
Jan 15 03:35:08 app-01 postgres[8271]: checkpoint complete: wrote 128 buffers (0.8%)
Specifications
- Lines
- 32
- Format
- RFC 3164 (BSD syslog)
- Fields
- timestamp, host, process[pid], message
- Seed
- 503
What is a .log file?
LOG files are plain-text records of events emitted by software, typically one entry per line with a timestamp, severity, and message. There is no single standard, so formats range from unstructured text to structured JSON lines. They are central to debugging, monitoring, and auditing.
How to use this file
Use an example LOG file to test log parsers, timestamp and severity extraction, line-oriented streaming, and ingestion into monitoring or analysis pipelines.
How to use this file for testing
“Syslog Messages — RFC 3164 (log)” is a deterministic Novus Examples fixture for Log parsing, Observability. Access logs and JSON-lines application logs — for testing log parsers, tailers, and ingestion pipelines.
Documented properties for this file: seed 503 · RFC 3164 (BSD syslog). Compare results against paired or grouped companions on this page when present (clean↔damaged, searchable↔scanned, or format twins) so scores stay reproducible across runs.
Download the file once, keep the path stable in CI or local scripts, and treat the spec table as the contract: dimensions, seeds, field lists, and roles are intentional. Corrupt or invalid samples are labelled as such — expect parsers to fail loudly rather than silently accept them.
Data fixtures document their exact quirks — delimiters, encodings, null handling, schema, and row counts — in the spec table. Point your parser or importer at the file and assert it handles the documented edge cases; clean and deliberately-messy siblings make before/after diffs straightforward.
Code examples
grep -i error syslog.log | head
awk '{print $1, $2, $NF}' syslog.log | headRelated files
- logApache Access Log — Combined Format (log)An Apache access log in the Combined Log Format — the Common fields plus referer and user-agent. A realistic web-server log for testing access-log parsers, analytics, and grok patterns.
- logApache Access Log — Common Format (log)An Apache access log in the Common Log Format (CLF) — client, timestamp, request line, status, and byte count. Deterministic, with reserved documentation IPs. Paired with a Combined-format twin for testing log parsers.
- logDocker Container Log — json-file driver (log)A Docker json-file container log — one JSON object per line with the log text, stream (stdout/stderr), and an RFC 3339 timestamp, exactly as Docker's default logging driver writes it. A fixture for container-log shippers and parsers.
- logKubernetes Component Log — klog (log)A Kubernetes-component log in the klog/glog format — a severity letter, timestamp, thread id, and source location prefix followed by the message. A fixture for testing klog parsers and severity extraction.
- logStructured Log — logfmt (log)A structured application log in logfmt — space-separated key=value pairs (ts, level, msg, method, path, status, duration, request_id) as used by many Go and Heroku-style services. A fixture for testing logfmt parsers.
- log.NET Exception with an Inner Exception Chain (log)A .NET exception whose inner exception is introduced by the ---> marker and closed by End of inner exception stack trace, wrapped in pipe-delimited log lines. Error groupers that key on the outermost message alone merge two genuinely different faults here.
Generated by generation/data_logs.py. Free for any use, no attribution required — license.