Syslog packets are described in RFC3164 (http://www.faqs.org/rfcs/rfc3164.html)

Layer1:  [------------------Syslog Packet Format-----------------------]
Layer2:  [PRI][-----------HEADER------------][----------MSG------------]
Layer3:  [PRI][--TIMESTAMP--]X[--HOSTNAME--]Y[--TAG-][-----CONTENT-----]
Example: <150>Jan  6 19:34:07 192.168.10.100 rpd[873]: Foojabee! Hooya!!

Contentent take from RFC3164 for reference...

Syslog Packet:

  The full format of a syslog message seen on the wire has three
  discernable parts.  The first part is called the PRI, the second part
  is the HEADER, and the third part is the MSG.  The total length of
  the packet MUST be 1024 bytes or less.  There is no minimum length of
  the syslog message although sending a syslog packet with no contents
  is worthless and SHOULD NOT be transmitted.

PRI:

  The PRI part MUST have three, four, or five characters (counting the
  angle brackets) and will be bound with angle brackets as the first and
  last characters. The PRI containts the PRIORITY and SEVERITY as
  descibed in section 4.1.1.  Leading "0"s MUST NOT be used.

HEADER:

  The HEADER contains two fields called the TIMESTAMP and the HOSTNAME.
  The TIMESTAMP will immediately follow the trailing ">" from the PRI
  part and single space characters MUST follow each of the TIMESTAMP
  and HOSTNAME fields.  HOSTNAME will contain the hostname, as it knows
  itself.

MSG:

  The MSG part will fill the remainder of the syslog packet.  This will
  usually contain some additional information of the process that
  generated the message(TAG), and then the text of the message(CONTENT).

TIMESTAMP:

  The TIMESTAMP field is the local time and is in the format of "Mmm dd
  hh:mm:ss" where:

    Mmm is the English language abbreviation for the month of the
    year with the first character in uppercase and the other two
    characters in lowercase.

    dd is the day of the month.  If the day of the month is less
    than 10, then it MUST be represented as a space and then the
    number.

    hh:mm:ss is the local time.  The hour (hh) is represented in a 24-hour
    format.  Valid entries are between 00 and 23, inclusive.  The minute
    (mm) and second (ss) entries are between 00 and 59 inclusive.

   A single space character MUST follow the TIMESTAMP field. (X)

HOSTNAME:

  The HOSTNAME field will contain only the hostname, the IPv4 address,
  or the IPv6 address of the originator of the message.  The preferred
  value is the hostname.  If the hostname is used, the HOSTNAME field
  MUST contain the hostname of the device as specified in STD 13 [4].
  It should be noted that this MUST NOT contain any embedded spaces.
  The Domain Name MUST NOT be included in the HOSTNAME field.  If the
  IPv4 address is used, it MUST be shown as the dotted decimal notation
  as used in STD 13 [5].  If an IPv6 address is used, any valid
  representation used in RFC 2373 [6] MAY be used.  A single space
  character MUST also follow the HOSTNAME field. (Y)

TAG:

  The TAG is a string of ABNF alphanumeric characters that MUST NOT exceed 32
  characters.  Any non-alphanumeric character will terminate the TAG field and
  will be assumed to be the starting character of the CONTENT field.  Most
  commonly, the first character of the CONTENT field that signifies the
  conclusion of the TAG field has been seen to be the left square bracket
  character ("["), a colon character (":"), or a space character.

CONTENT:

  The CONTENT contains the details of the message.  This has traditionally been
  a freeform message that gives some detailed information of the event.
  
X:

  Must be a single space. Described in section 4.1.2.

Y:

  Must be a single space. Described in section 4.1.3.
