§2024-06-+05

Understanding Facilities

Facilities in syslogs are used to categorize log messages based on their sources or purposes. They provide a way to differentiate between various components of a Linux system.

Syslog Facilities Syslog defines a set of standard facilities, such as:

auth: security/authorization messages cron: clock daemon daemon: system daemons without their own facility kern: kernel messages mail: mail system syslog: internal syslog messages user: generic user-level messages local0 to local7: user-defined facilities for custom purposes

What Are Syslog Levels? Syslog defines eight categories from 0 (emergency) to 7 (Debug level). These levels are used to classify messages based on their severity. Levels 5 - 7 are mostly used by applications, while 0 - 4 are mostly used by the operating system. For example, we can enable debug logs when developing or troubleshooting an application and change the log level to errors or warnings when we deploy it. Here are the syslog levels, along with their numeric codes:

0 - emergency: System is unusable. This level indicates a catastrophic failure or a situation that requires immediate attention.

1 - alert: Immediate action is needed. This level indicates a condition that should be corrected immediately, such as a critical system component failure.

2 - critical: Critical conditions. This level indicates a severe error or problem that requires prompt attention.

3 - error: Error conditions. This level indicates non-critical errors that may require investigation or troubleshooting.

4 - warning: Warning conditions. This level indicates a potential problem or situation that should be monitored or addressed.

5 - notice: Normal but significant conditions. This level indicates noteworthy events but is not necessarily indicative of an error.

6 - informational: Informational messages. This level provides general operational information or status updates.

7 - debug: Debug-level messages. This level denotes detailed debugging and diagnostic information.

Depending on the logging configuration, messages can be filtered or handled differently based on their level.