Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was reading about logs (syslog) being exported in IPFIX format. And some products which do this as well. What I didn't find, was if there is any standard/known ways of doing this ?. Like if there are any specific information-elements meant for syslog? Or, is it totally proprietary methods (like using all vendor specific fields which is allowed in IPFIX) And, for these schemes, does one use plain IPFIX, or structured-IPFIX ? TIA for any info/pointers on this.


I am not looking for any info on products, only the method/standards if any for this.

share|improve this question
up vote 1 down vote accepted

As DukeLion says IPFIX is not supposed for general syslog data, but it's possible to export some paticular types of logs, which contain network traffic data (like Apache access logs) using standard IPFIX entities.

Illuminating message from old discussion on IETF:

In discussions with the IPFIX sub-group it was clear that they did not really desire a logging file format - this was a means to specify a format for streaming binary information to collectors and that they had additional goals which included the ability to correlate signalling information with information on media flows.

share|improve this answer

To export syslog information using IPFIX you want a Syslog to IPFIX mediator. General information about IPFIX medaitors can be found in draft-ietf-ipfix-mediation-protocol.

There is no restriction on sending strings like syslog messages using IPFIX. There are not currently any standard Information Elements (IEs) for syslog messages. IPFIXify uses proprietary/non-standard IEs for syslog info.

Just to be clear by proprietary I really mean "not necessarily public" or "not standard". A few exporters play their proprietary IEs very close to the vest, but details about most "proprietary" IEs is available if you look. Adding proprietary IEs is a great way to start experimenting with innovative exports. Standard IEs can also be requested by anyone (pending expert review). Every IPFIX exporter I can think of has at least some proprietary IEs.

An other point to make here is that IPFIX allows you to mix and match standard and proprietary IEs (not just send "totally proprietary" IEs). This is important because a collector can provide some reporting using the IEs it knows about and ignoring the others.

I'm not sure what you mean by plain vs. structured IPFIX?

I think that covers all your questions.

share|improve this answer
ok, when I said "structured IPFIX", I was referring to RFC6313. – vyom Jan 13 '14 at 4:55

IPFIX is supposed to exchange information about network usage - packets, bytes flowing through some network device. I don't think it's possible to put custom text messages into it.

share|improve this answer
yea, that is what I used to think as well, but there seem to be some products out there - like IPFIXify, which do this (oh, and BTW, I am not interested in the products, all I want to understand, is the technology/workings behind it) – vyom Aug 10 '13 at 18:11

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.