bokamba / loganvil / RFC 3164 (BSD) syslog

$ loganvil generate syslog3164

Generate synthetic RFC 3164 (BSD) syslog

Generate realistic synthetic RFC 3164 (BSD) syslog logs for pipeline testing, SIEM demos, and detection tuning — deterministic and 100% client-side. Each line follows the classic BSD framing — "Mon DD HH:MM:SS host tag[pid]: message" — from daemons like CRON, systemd, sudo and kernel, so it exercises your syslog receiver and parser exactly. No real hosts or secrets.

Open the LogAnvil generator →

This sample, generated

The block below is 15 lines of RFC 3164 (BSD) syslog, produced by the real generator at seed 42 — deterministic, so this exact output regenerates anywhere. The live tool re-runs the identical engine on whatever source, seed, line count and anomalies you pick.

15lines
4.3stime span
0anomaly lines
42seed

no anomalies injected — raise a slider to seed detectable patterns

Generated RFC 3164 (BSD) syslog

Real on-the-wire RFC 3164 (BSD) syslog — no real users, IPs, or secrets. Copy it into a fixture, feed it to a parser, or seed a SIEM demo.

Sep 13 12:26:40 db-02 kernel[27948]: Time has been changed
Sep 13 12:26:40 db-01 systemd[20509]: Starting Daily apt upgrade and clean activities...
Sep 13 12:26:40 app-01 dhclient[24461]: Started Session of user root.
Sep 13 12:26:40 db-01 sudo[20047]: (root) CMD (/usr/local/bin/backup.sh --nightly)
Sep 13 12:26:41 lb-01 CRON[19450]: (root) CMD (/usr/local/bin/backup.sh --nightly)
Sep 13 12:26:41 web-01 CRON[25696]: pam_unix(cron:session): session opened for user root
Sep 13 12:26:41 web-02 dhclient[16033]: Starting Daily apt upgrade and clean activities...
Sep 13 12:26:41 db-01 CRON[1778]: pam_unix(cron:session): session opened for user root
Sep 13 12:26:42 app-01 sudo[6944]: Started Session of user root.
Sep 13 12:26:42 lb-01 kernel[6770]: Started Session of user root.
Sep 13 12:26:42 web-01 sudo[22339]: Time has been changed
Sep 13 12:26:43 web-01 dhclient[14184]: Starting Daily apt upgrade and clean activities...
Sep 13 12:26:43 web-01 CRON[11875]: pam_unix(cron:session): session opened for user root
Sep 13 12:26:43 mail-01 CRON[23607]: Starting Daily apt upgrade and clean activities...
Sep 13 12:26:44 cache-01 CRON[17097]: Starting Daily apt upgrade and clean activities...

With an anomaly injected: SSH brute-force

The same source, regenerated with a SSH brute-force injected at 30% intensity. 6 line sare tagged and highlighted below — A burst of failed logins from one source IP, then a success — the classic credential-stuffing signature. It is a documented, detectable pattern your SIEM rules should fire on — build the test data, then prove your detection works.

Sep 13 12:26:40 db-02 kernel[27948]: Time has been changed
Sep 13 12:26:40 db-01 systemd[20509]: Starting Daily apt upgrade and clean activities...
Sep 13 12:26:40 app-01 dhclient[24461]: Started Session of user root.
Sep 13 12:26:40 db-01 sudo[20047]: (root) CMD (/usr/local/bin/backup.sh --nightly)
Sep 13 12:26:41 lb-01 CRON[19450]: (root) CMD (/usr/local/bin/backup.sh --nightly)
Sep 13 12:26:41 web-01 CRON[25696]: pam_unix(cron:session): session opened for user root
Sep 13 12:26:41 web-02 dhclient[16033]: Starting Daily apt upgrade and clean activities...
Sep 13 12:26:41 db-01 CRON[1778]: pam_unix(cron:session): session opened for user root
Sep 13 12:26:41 db-01 CRON[1778]: Failed password for postgres from 89.248.165.74 port 14539 ssh2SSH brute-force
Sep 13 12:26:41 db-01 CRON[1778]: Failed password for postgres from 89.248.165.74 port 14539 ssh2SSH brute-force
Sep 13 12:26:41 db-01 CRON[1778]: Failed password for postgres from 89.248.165.74 port 14539 ssh2SSH brute-force
Sep 13 12:26:41 db-01 CRON[1778]: Failed password for postgres from 89.248.165.74 port 14539 ssh2SSH brute-force
Sep 13 12:26:41 db-01 CRON[1778]: Failed password for postgres from 89.248.165.74 port 14539 ssh2SSH brute-force
Sep 13 12:26:41 db-01 CRON[1778]: Accepted password for postgres from 89.248.165.74 port 14539 ssh2SSH brute-force

FAQ

Are these real syslog messages?
No — the output is synthetic. It reproduces the RFC 3164 / BSD syslog framing (priority-free BSD timestamp, host, tag[pid], message) with realistic daemon messages, but every host and value is fabricated. Safe for fixtures, demos and receiver tests.
Can I inject anomalies?
Yes. Five detectable patterns are available; for a syslog stream an SSH brute-force burst or a port scan is appended in faithful syslog grammar, and the injected lines are highlighted and badged so you can prove your rules fire.
Is the output deterministic?
Yes — fully seeded. The same seed and config always produce byte-identical RFC 3164 lines, so a committed seed regenerates the exact same log anywhere.

Generate other log sources

Open the LogAnvil generator to tune the seed, line count, EPS, format and anomaly sliders — or build a parser with LogForge for a log you already have.

Generate your own RFC 3164 (BSD) syslog

Pick the seed, line count and EPS, inject the anomalies your rules should catch, and copy or download the result. Free, no account, nothing uploaded — generation runs entirely in your browser.

Open the LogAnvil generator →