One number, two pieces of information

The PRI value packs facility and severity into a single integer using a fixed formula — facility × 8 + severity — which is compact but genuinely opaque without decoding it: `<34>` at a glance tells you nothing, while "facility: auth, severity: Critical" tells you immediately that this is a security-relevant log entry worth attention. That encoding scheme dates back to the original BSD syslog protocol and has stayed unchanged through both the older RFC 3164 format and the newer, more structured RFC 5424, which is why decoding it correctly is the one piece of logic both format parsers share.

RFC 3164 vs. RFC 5424, and why both still show up

RFC 3164 documents the original, loosely-specified BSD syslog format — a human-readable timestamp, hostname, and a tag, with no formally required structure. RFC 5424 is the modern replacement: a stricter, versioned format with an ISO 8601 timestamp, explicit structured-data fields, and clearer delimiting between metadata and message. Despite 5424 being newer and better specified, an enormous amount of real infrastructure — routers, older Unix daemons, and plenty of application logging that never got updated — still emits 3164-style lines, which is why any practical syslog tool has to handle both rather than assuming the newer format is universal.