» IT tipps and howto's

Syslog-NG: Which are the possible log facilities to use?

Last Update: September 15 2010

As I was just doing some re-configuration of syslog-ng on a SLES11 server, I wanted to know the possible log facilities, as I created new filters.

filter f_user { facility(user); };

From the old syslog I knew that there is the 'user' log information, but to be sure and also to know all the others I was looking for a list in which all the log facilities are defined.
You find this in the following file: /usr/include/sys/syslog.h:

/* facility codes */
#define LOG_KERN (0<<3) /* kernel messages */
#define LOG_USER (1<<3) /* random user-level messages */
#define LOG_MAIL (2<<3) /* mail system */
#define LOG_DAEMON (3<<3) /* system daemons */
#define LOG_AUTH (4<<3) /* security/authorization messages */
#define LOG_SYSLOG (5<<3) /* messages generated internally by syslogd */
#define LOG_LPR (6<<3) /* line printer subsystem */
#define LOG_NEWS (7<<3) /* network news subsystem */
#define LOG_UUCP (8<<3) /* UUCP subsystem */
#define LOG_CRON (9<<3) /* clock daemon */
#define LOG_AUTHPRIV (10<<3) /* security/authorization messages (private) */
#define LOG_FTP (11<<3) /* ftp daemon */

So in my case I got the correct facility: user (you have to use user without the LOG_).