I'm new to remote logging with rsyslog and having looked through this page, I am unclear what each of the "locals" are used for. (EDIT - this SF question revealed a little more info)

I initially set up rsyslog to dump *.* to the remote server, but it is sending everything. I need to better understand what each of the locals do, so I know which ones to include or exclude to the remote server.

Are there standards for what types of log data gets written to each local?


local facilities are not used for anything specific and are application dependant. Usually consulting the documentation for the application will let you see what the default facility is and how it can possibly be customised.

See also RFC3164

Rather than focusing on local, focus on the application that is generating the message.

Sometimes using programname can help send specific messages to a destination.

e.g. I filter out dhcpd messages like this: In /etc/rsysconf.conf

if $programname == 'dhcpd' then /var/log/dhcpd.log

|improve this answer|||||
  • Is it possible to split logs into severity? IE, I want to store local6 with severity 5-7 in one file, and severity 1-4 in another. – a coder Apr 7 '15 at 17:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.