add new syslog facility

Question

I would like to use syslog to log messages coming from my PHP based site. My question is - can I add custom facility name? I know there are predefined facilities like:

auth, authpriv, cron, dæmon, kern, lpr, mail, mark, news, syslog, user, UUCP and local0 through local7.

And as I understand I could use local0 - local6 facilities for this.

But I just feel that if I could add something like this to syslog:

mySiteName.* /var/log/mySiteName.log

It would be visually easier to understand for others. Unfortunately above line results in:

rsyslogd-3000: unknown facility name "mySiteName"

So - is there a way to use custom facility name?

Answer 1

The syslog interface only allows a fixed set of facilities, defined by constants in /usr/include/sys/syslog.h. The only provision for custom facilities are local0 through local7.

What you can do to separate the logs of various servers is use filters to match on the origin or text of each log message. Rsyslog has fairly powerful filters (read the properties available for matching).

Answer 2

Not exactly applying to the question but hopefully useful example for daemons not providing their own facility:

:programname, isequal, "uptimed" /var/log/uptimed.log