Summary

  • A syntactically valid syslog configuration can retain the symptom of a failure while excluding the event that would distinguish its cause. RFC 9742 exposes these choices; it does not guarantee an incident history.
  • Selection, effective configuration, delivery and collector retention are separate claims. Optional features and implementation-defined limits make the same module name an inadequate assurance of equivalent evidence.
  • The consequential authority sits with whoever can change filters and retention before the incident, and whoever can independently establish what those settings actually did.

A clean search can conceal an earlier choice

Imagine an authentication problem followed by an outage. The remote archive contains errors, but not the lower-urgency messages that might distinguish an unauthorized change from a legitimate intervention. This is a hypothetical case, not a reported failure. Its point is that the missing discriminator could have been excluded while every component was working as configured. Searching harder afterward would not recover an event that never entered the selected output.

That possibility is the useful leadership reading of RFC 9742, published on the IETF Standards Track in April 2025. Its ietf-syslog YANG model standardizes configuration for messages directed to a console, local files and remote relays or collectors. Standardization makes a policy easier to express and compare. It does not establish that the underlying application emitted every relevant event, that an output received it, or that a later investigator can retrieve it. Publication of the standard is also not evidence that any particular device implements it.

The important unit is the output action. A console, a named file and a named remote destination each use a selector. “Logging is enabled” therefore leaves the central question unanswered: enabled for which messages, at which destination? Two archives can contain different histories of the same device without either contradicting the configuration.

Severity changes the available explanation

The default severity comparison selects the configured urgency and greater urgency. Syslog’s numerical scale runs in the opposite direction: more urgent severities have lower numbers. Setting error does not mean retaining only messages whose severity is exactly error. It also admits more urgent classes; it can still omit less urgent context that becomes decisive after the outcome is known.

The model also provides explicit all and none severity values. More elaborate comparisons depend on the optional select-adv-compare feature. When present, the comparison can be equals or equals-or-higher, and its action can log, block, or stop further processing of the message. The defaults in that advanced container are equals-or-higher and log. An operational account that says only “error-level logging” conceals whether equality, a threshold or a blocking rule was involved.

Regular-expression selection adds another boundary. The optional select-match feature enables pattern-match. The normative module describes a POSIX expression evaluated against SYSLOG-MSG, the complete syslog message, rather than just its final MSG text. When facility selection and the pattern are both configured, both must match. A facility rule that appears generous can thus be narrowed by a pattern. Changes in message wording or formatting can matter to a selection rule even when the event’s operational significance has not changed. That is an implementation-testing question; this article has not measured a vendor’s matcher or claimed a universal execution order for every filter list.

The decision is not simply how much noise an operator accepts. It is which alternative explanations the organization will later be able to test. A successful recovery message may be less urgent than an error, yet it can distinguish a failed remedy from an effective one. Severity classifies a message at generation; it does not rank every possible future evidentiary use.

A file limit is not a promised historical horizon

Local storage introduces a different form of selection: survival over time. file-limit-size makes the maximum retained file count and maximum file size available. The file-count leaf defaults to one. file-limit-duration makes rollover and retention available, both expressed in minutes. These are optional capabilities, not a mandatory retention period imposed by the RFC.

The details prevent a convenient but misleading shortcut. Rollover describes closing the active file when events arrive after its interval. Retention describes how long completed or closed files should remain before removal. Neither is a blanket statement that every individual event is recoverable for that many minutes after occurrence. Unspecified archive limits are implementation-defined. The archive naming and removal discussion in Appendix B.3 is informative guidance, not a compulsory rotation algorithm or a guarantee about the precedence of combined limits.

Consider a size-constrained archive during a message burst. More data can consume its available history faster. That is a capacity mechanism, not a measured retention formula: compression, event size, archive counting, other limits and implementation behavior would all affect the observed result. Multiplying a file count by a size does not produce a reliable time horizon. An apparently unchanged configuration can offer less historical coverage precisely when a noisy failure produces more messages.

Nor does a local archive necessarily constitute independent preservation. If the device and its storage share the failure that prompts investigation, their common location matters. A remote destination changes that dependency, but introduces delivery and collector policies that the local file settings cannot settle.

Transport protects a narrower claim

Each named remote destination has a mandatory transport choice between UDP and TLS, with addresses listed inside the selected case. The default ports are 514 and 6514 respectively. The choice belongs to that destination entry; it should not be inflated into a prohibition on separately named destinations using different transports.

RFC 5426 explains that UDP delivery is unreliable: messages can disappear without notice, and arrival order is not an authoritative event sequence. TLS improves confidentiality and integrity on the transport hop when appropriately authenticated and authorized. But RFC 5425 explicitly separates the authenticated sender’s identity from the message’s HOSTNAME. A trusted relay connection does not, by itself, prove the truth of an origin claim inside its payload.

TLS also does not provide a collector’s archival receipt. Its syslog mapping has no application-layer acknowledgements; after a broken session, the sender cannot always know which messages reached the peer application, as §6.3 states. Persistent storage, later deletion and interpretation are further claims. Encryption cannot restore something a selector rejected before transmission.

The optional structured-data switch on file and remote actions deserves similar precision. It defaults to false; false writes the structured field as NILVALUE, while true writes one or more structured-data elements. RFC 5424 defines that parseable field separately from the optional message text. Enabling it does not manufacture missing facts or validate an application’s interpretation. Disabling it can remove structured context that another consumer was expected to use.

The common name hides a capability question

A common schema is valuable precisely because it makes differences inspectable. It does not abolish them. YANG Library, RFC 8525, identifies module revisions, supported features, deviations and datastore schemas. Under YANG’s if-feature rules, conditionally defined nodes depend on server support. A management system cannot infer regex matching or time-based retention from the string ietf-syslog alone.

Vendor extensions add another limit. RFC 9742’s Appendix B.1 warns that extended facilities may not work with the RFC 5424 wire protocol and therefore apply to local syslog-like functionality. A local facility label is not automatically a portable remote classification. Likewise, facility-override deliberately replaces the facility sent to a remote server; an optional source-interface setting chooses an egress interface, not an authenticated institutional identity.

Finally, intended policy and policy in use differ. RFC 8342 distinguishes transformed intended configuration from operational configuration actually used by the system, with reporting caveats. Comparing those views can establish a present discrepancy. A snapshot taken after recovery cannot alone establish the incident-time setting.

The conclusion is bounded but consequential. RFC 9742 supplies a vocabulary for choices that influence future evidence. It supplies neither a complete incident record nor an automatic audit. An absence becomes interpretable only after the earlier selection, operating state, delivery and preservation boundaries have been established. Until then, “nothing found” describes the archive searched, not necessarily the event that occurred.