Is there a syslog private enterprise number for custom/internal use?

Question

So I recently was looking for a way to add extra metadata to logs and found out that syslog got me covered. I can add custom metadata using SD-ID feature like this:

[meta@1234 project="project-name" version="1.0.0-RC5" environment="staging" user="[email protected]"] 

The problem is that 1234 has to be a syslog private enterprise number. I assume those are given to big companies like microsoft or apple, but not to indie developers. So My question is, is there a reserved number for internal use that everyone could use without registration for internal purpose?

Answer 1

If you use RFC5424-formatted messages, you can (or could) create custom fields in the SDATA (Structured Data) part of the message.

The latter part of a custom field in the SDATA is, as you mentioned, the private enterprise number (or enterpiseId).

As per RFC5424 defined:

7.2.2. enterpriseId

The "enterpriseId" parameter MUST be a 'SMI Network Management Private Enterprise Code', maintained by IANA, whose prefix is iso.org.dod.internet.private.enterprise (1.3.6.1.4.1). The number that follows MUST be unique and MUST be registered with IANA as per RFC 2578 [RFC2578].

Of course it depends on what you're using it for, if it's only for local logs, you can use any enterpriseId or you can even use a predefined SDATA field with a reserved SD-ID and rewrite it's value. (See: syslog-ng Guide)