bokamba / loganvil / RFC 5424 syslog

$ loganvil generate syslog5424

Generate synthetic RFC 5424 syslog

Generate realistic synthetic RFC 5424 syslog logs for pipeline testing, SIEM demos, and detection tuning — deterministic and 100% client-side. Each line carries the modern structured framing — "<PRI>1 ISO-timestamp host app procid msgid SD message" — with NILVALUE msgid/structured-data, so it exercises an RFC 5424-aware receiver and parser precisely. No real hosts or secrets.

Open the LogAnvil generator →

This sample, generated

The block below is 15 lines of RFC 5424 syslog, produced by the real generator at seed 42 — deterministic, so this exact output regenerates anywhere. The live tool re-runs the identical engine on whatever source, seed, line count and anomalies you pick.

15lines
4.6stime span
0anomaly lines
42seed

no anomalies injected — raise a slider to seed detectable patterns

Generated RFC 5424 syslog

Real on-the-wire RFC 5424 syslog — no real users, IPs, or secrets. Copy it into a fixture, feed it to a parser, or seed a SIEM demo.

<115>1 2020-09-13T12:26:40.000Z db-01.example.com deploy 21978 - - upstream timed out while connecting to upstream
<52>1 2020-09-13T12:26:40.340Z db-02.example.com deploy 15529 - - Accepted publickey for berkay from 192.0.2.10 port 50022 ssh2
<143>1 2020-09-13T12:26:40.775Z app-01.example.com nginx 16457 - - duplicate key value violates unique constraint
<0>1 2020-09-13T12:26:41.138Z db-01.example.com deploy 1772 - - backend api has no server available
<51>1 2020-09-13T12:26:41.346Z web-01.example.com nginx 25696 - - backend api has no server available
<33>1 2020-09-13T12:26:41.553Z lb-01.example.com postgres 26529 - - Accepted publickey for berkay from 192.0.2.10 port 50022 ssh2
<7>1 2020-09-13T12:26:41.873Z web-01.example.com postgres 19593 - - Accepted publickey for berkay from 192.0.2.10 port 50022 ssh2
<40>1 2020-09-13T12:26:42.245Z app-01.example.com haproxy 28152 - - backend api has no server available
<54>1 2020-09-13T12:26:42.499Z app-01.example.com nginx 21656 - - duplicate key value violates unique constraint
<178>1 2020-09-13T12:26:42.884Z web-01.example.com deploy 14184 - - heartbeat ok latency=12ms
<21>1 2020-09-13T12:26:43.121Z web-01.example.com sshd 15836 - - duplicate key value violates unique constraint
<14>1 2020-09-13T12:26:43.561Z cache-01.example.com deploy 9189 - - duplicate key value violates unique constraint
<99>1 2020-09-13T12:26:43.809Z lb-01.example.com nginx 32625 - - backend api has no server available
<83>1 2020-09-13T12:26:44.253Z db-02.example.com sshd 19577 - - Accepted publickey for berkay from 192.0.2.10 port 50022 ssh2
<56>1 2020-09-13T12:26:44.648Z db-01.example.com deploy 22806 - - heartbeat ok latency=12ms

With an anomaly injected: SSH brute-force

The same source, regenerated with a SSH brute-force injected at 30% intensity. 6 line sare tagged and highlighted below — A burst of failed logins from one source IP, then a success — the classic credential-stuffing signature. It is a documented, detectable pattern your SIEM rules should fire on — build the test data, then prove your detection works.

<115>1 2020-09-13T12:26:40.000Z db-01.example.com deploy 21978 - - upstream timed out while connecting to upstream
<52>1 2020-09-13T12:26:40.340Z db-02.example.com deploy 15529 - - Accepted publickey for berkay from 192.0.2.10 port 50022 ssh2
<143>1 2020-09-13T12:26:40.775Z app-01.example.com nginx 16457 - - duplicate key value violates unique constraint
<0>1 2020-09-13T12:26:41.138Z db-01.example.com deploy 1772 - - backend api has no server available
<51>1 2020-09-13T12:26:41.346Z web-01.example.com nginx 25696 - - backend api has no server available
<33>1 2020-09-13T12:26:41.553Z lb-01.example.com postgres 26529 - - Accepted publickey for berkay from 192.0.2.10 port 50022 ssh2
<7>1 2020-09-13T12:26:41.873Z web-01.example.com postgres 19593 - - Accepted publickey for berkay from 192.0.2.10 port 50022 ssh2
<40>1 2020-09-13T12:26:42.245Z app-01.example.com haproxy 28152 - - backend api has no server available
Failed password for admin from 89.248.165.74 port 5842 ssh2SSH brute-force
Failed password for admin from 89.248.165.74 port 5842 ssh2SSH brute-force
Failed password for admin from 89.248.165.74 port 5842 ssh2SSH brute-force
Failed password for admin from 89.248.165.74 port 5842 ssh2SSH brute-force
Failed password for admin from 89.248.165.74 port 5842 ssh2SSH brute-force
Accepted password for admin from 89.248.165.74 port 5842 ssh2SSH brute-force

FAQ

Are these real RFC 5424 messages?
No — the output is synthetic. It reproduces the RFC 5424 structure exactly (PRI, version 1, ISO 8601 timestamp, hostname, app-name, procid, NILVALUE msgid and structured data, message), but every value is fabricated. Safe for fixtures, demos and receiver conformance tests.
Can I inject anomalies?
Yes. Raise any of the five sliders; for a syslog source an SSH brute-force or port-scan pattern is appended in faithful grammar, with the injected lines highlighted and badged so you can verify detection.
Is the output deterministic?
Yes — fully seeded. The same seed and config always produce byte-identical RFC 5424 lines, so a committed seed regenerates the identical log on any machine or in CI.

Generate other log sources

Open the LogAnvil generator to tune the seed, line count, EPS, format and anomaly sliders — or build a parser with LogForge for a log you already have.

Generate your own RFC 5424 syslog

Pick the seed, line count and EPS, inject the anomalies your rules should catch, and copy or download the result. Free, no account, nothing uploaded — generation runs entirely in your browser.

Open the LogAnvil generator →