LOG_LOCAL

[craymond]

What is the idea/reason behind the facility setting for syslog? Is LOG_USER, and LOG_LOCAL0-7 just a method of ID, or is there something more to it? When setting up to send to a syslog server should you aviod using LOG_USER and use LOG_LOCAL(0-7)?

[kprakash · Accepted solution]

The syslog facility can be configured within the system when setting the syslog destination. Multiple syslog settings can be configured and referenced by the various log forwarding function if desired. The available facilities are: user, local0, local1, local2, local3, local4, local5, local6, and local7.

A facility level is used to specify what type of program is logging the message. This lets the configuration file specify that messages from different facilities will be handled differently.[4] The list of facilities available:[5] (defined by RFC 3164)

Facility Number Keyword Facility Description

0 kern kernel messages

1 user user-level messages

2 mail mail system

3 daemon system daemons

4 auth security/authorization messages

5 syslog messages generated internally by syslogd

6 lpr line printer subsystem

7 news network news subsystem

8 uucp UUCP subsystem

9 clock daemon

10 authpriv security/authorization messages

11 ftp FTP daemon

12 - NTP subsystem

13 - log audit

14 - log alert

15 cron clock daemon

16 local0 local use 0 (local0)

17 local1 local use 1 (local1)

18 local2 local use 2 (local2)

19 local3 local use 3 (local3)

20 local4 local use 4 (local4)

21 local5 local use 5 (local5)

22 local6 local use 6 (local6)

23 local7 local use 7 (local7)

For more reference on syslog facilities, refer to the below link:

http://en.wikipedia.org/wiki/Syslog#Facility_Levels

BR,

Karthik RP

[sraghunandan]

You can refer this too https://live.paloaltonetworks.com/docs/DOC-2021

[kprakash]

You can also refer to the below doc:

https://live.paloaltonetworks.com/docs/DOC-2021

BR,

Karthik RP

[craymond]

By the Docs, and explanations, it is just a method of ID. You could set up different settings and use different facilities to reference them, or for different servers or however you want.

[vcappuccio]

Just in case, I hope this helps someone

The Facilities and Severities of the messages are numerically coded with decimal values. Some of the operating system daemons and processes have been assigned Facility values. Processes and daemons that have not been explicitly assigned a Facility may use any of the "local use" facilities or they may use the "user-level" Facility. Therefore, for the facility levels:

16 local use 0 (local0)

17 local use 1 (local1)

18 local use 2 (local2)

19 local use 3 (local3)

20 local use 4 (local4)

21 local use 5 (local5)

22 local use 6 (local6)

23 local use 7 (local7)

Similarly the numerical values for the severity levels is :

0 Emergency: system is unusable

1 Alert: action must be taken immediately

2 Critical: critical conditions

3 Error: error conditions

4 Warning: warning conditions

5 Notice: normal but significant condition

6 Informational: informational messages

7 Debug: debug-level messages

The Priority value (the first component of a syslog message) is calculated by first multiplying the Facility number by 8 and then adding the numerical value of the Severity. For example, a kernel message (Facility=0) with a Severity of Emergency (Severity=0) would have a Priority value of 0. Also, a "local use 4" message (Facility=20) with a Severity of Notice (Severity=5) would have a Priority value of 165. In the PRI part of a Syslog message, these values would be placed between the angle brackets as <0> and <165> respectively.