LabVIEW Syslog Protocol Reference Library

Publish Date: Jun 08, 2011 | 7 Ratings | 3.29 out of 5 | Print | 2 Customer Reviews | Submit your review


The syslog protocol is a simple UDP communication standard for sending messages from distributed systems and processes to a central collector for logging and later analysis. It can be used for debugging embedded and distributed applications by sending simple messages from the embedded code to a separate system running the syslog collector, also called the syslog server or daemon. One particular application of this component is the debugging of compiled LabVIEW Real-Time (RT) executables, which do not have their own user interface. Instead of streaming messages to the serial port of a LabVIEW Real-Time controller, you can send messages over the network to another system running the syslog collector.

Table of Contents

  1. Syslog Overview
  2. Syslog Reference Library
  3. Implementation
  4. Integration


This reference design library was created by the NI Systems Engineering group. 

You can give us feedback by posting questions and comments through the Syslog component discussion thread

1. Syslog Overview

Syslog is an internet standard for sending short text messages from distributed systems to a central syslog server, daemon or collector. Syslog is now standardized within the Syslog working group of the IETF (International Engineering Task Force). It is documented in detail in RFC 3164 of the IETF.

Syslog messages have the following format:

<12>Jul 16 14:52:34 cRIO_Controller_2 DAQ_Process: Error 54

The first part of the messages '<12>' is called PRI (priority) and is a combination of a severity code and facility code which identify the source and severity of the syslog message. Severity codes include levels such as emergency, critical, error, warning, notice. Facility codes include kernel, user, mail system, network news, etc. From the facility codes we can see that syslog is intended for use on server types of systems, but can be used on any type of embedded or networked application. The complete list of severity and facility codes and how the PRI header is calculated is provided in section 4.1.1 of RFC 3164.

The second part of the syslog message 'Jul 16 14:52:34 cRIO_Controller_2 " is called the HEADER. It consists of a time stamp and the IP hostname of the sender. The HEADER is complete documented in section 4.1.2 of RFC 3164.

The third and last part of the syslog message 'DAQ_Process: Error 54' is called MSG. It contains a text message provided by the sender using 7-bit printable ASCII characters. The MSG part contains a tag and content field. The tag field 'DAQProcess' identifies in more detail the process which is sending the message. For LabVIEW this could be the name of the VI or an identifier of the process or loop sending the message. The content field contains the description of the error or condition being reported.

The total length of a syslog message including PRI and HEADER must not exceed 1024 bytes.

Back to Top

2. Syslog Reference Library

The LabVIEW Syslog reference library provided with this example contains a set of three VIs each for the device (message sender) and the collector (message receiver). The VIs can be placed on the diagram from the syslog palette in the user library function palette. 

Figure 1: Syslog function palette 

The top three Vis are used for the device, while the bottom three VIs are used for the collector.

Syslog Device VIs

To send messages to a syslog collector you must initialize the device communication using the Syslog Device Init VI. This VI requires the IP address or host name of the machine running the syslog collector.

Once the syslog device communication has been initialized you can call the Syslog Device Send VI anywhere in your application to send messages to the collector. This VI has four inputs which are the message tag and content, as well as enumerations for the severity and facility codes..

You can also call the Syslog Device Send VI with only the error cluster connected (leave the message tag and content empty). In this case the VI will send a message to the collector if the error code is anything other than 0.

At the completion of the application you should call the Syslog Device Close VI to deallocate any resources from the communication.

Figure 2: Example showing the use of the Syslog Device VIs

Syslog Collector VIs

The Syslog Collector VIs are used to receive syslog message sent from the device VIs. They are used like the UDP functions in LabVIEW. The Syslog Collector Init VI opens UDP port, ready to receive syslog messages. 

The Syslog Collector Reference is wired to the Syslog Collector Read VI to read syslog messages from the port buffer. The messages are returned in raw form as a string and parsed form as a cluster. The message data can be handled or processed in a number of different ways. The Syslog reference library includes a Syslog Collector example which displays received messages in a running log on the user interface and also logs them to a file. 

When you are done receiving messages close the open port using the Syslog Collector Close VI.

Figure 3: Block diagram of the example Syslog Collector

Back to Top

3. Implementation

The syslog VIs are based on the standard UDP functions in LabVIEW. The implementation of the individual VIs is fairly simple and easily understood by reviewing the diagrams for each of the VIs. 

The Syslog Device VIs use an underlying resource manager VI (similar to a LabVIEW functional global variable) which handles the three basic functions of the API and associated state information in a single VI ( 

Figure 4: Underlying Syslog Device VIs function engine implementation, showing the Init function

In the Init function the default local port used by the device is 514, which is the required port for a syslog collector. If the device is connecting to a syslog collector on the same machine it must use a different port number for the connection to be established. This is not a typical use of the syslog VIs.

Back to Top

4. Integration

The LabVIEW Syslog reference library can be used with third-party syslog collector applications available on the market. The syslog Device VIs will send syslog messages to the machine identified by the IP address where any running syslog collector will receive and display the messages.

The Syslog reference library VIs have been tested successfully with a number of third-party collectors including TheOne SysLog Manager Lite (v3.6.0) and LoriotPro Syslog Collector.

Figure 5: LabVIEW syslog messages logged in a third party Syslog collector application

Note: National Instruments does not endorse any of the third-party products or companies mentioned in this tutorial. >> Terms of Use

Back to Top

Customer Reviews
2 Reviews | Submit your review

Bug in syslog_Message Parse  - Aug 28, 2014

Hi, I noticed that the time displayed is 1 hour more than expected. I think in "syslog_Message Parse" the DST input on "Date/Time To Seconds" should be set to -1. This works now for me. Best regards Jürgen Tritthardt

Great reference!  - Apr 18, 2010

This reference design shows great solutions for many of the challenges that we face in implementing streaming / monitoring systems. The architectural use of action engines keeps things nice and neat. My only suggestion is that it would be nice to see those action engines implemented in LVOOP!

Bookmark & Share








Rate this document

Answered Your Question?
Yes No