I would like to use syslog to log messages coming from my PHP based site. My question is - can I add custom facility name? I know there are predefined facilities like:

auth, authpriv, cron, dæmon, kern, lpr, mail, mark, news, syslog, user, UUCP and local0 through local7.

And as I understand I could use local0 - local6 facilities for this.

But I just feel that if I could add something like this to syslog:

mySiteName.* /var/log/mySiteName.log

It would be visually easier to understand for others. Unfortunately above line results in:

rsyslogd-3000: unknown facility name "mySiteName"

So - is there a way to use custom facility name?

2 Answers 2


The syslog interface only allows a fixed set of facilities, defined by constants in /usr/include/sys/syslog.h. The only provision for custom facilities are local0 through local7.

What you can do to separate the logs of various servers is use filters to match on the origin or text of each log message. Rsyslog has fairly powerful filters (read the properties available for matching).

  • on ARM platforms the mentioned header is in (eg. RPiOS) /usr/include/arm-linux-gnueabihf/sys/syslog.h
    – Paul Wratt
    Feb 2, 2022 at 3:28

Not exactly applying to the question but hopefully useful example for daemons not providing their own facility:

:programname, isequal, "uptimed" /var/log/uptimed.log
  • 2
    Which syslog implementation are you referring to? (Or is this standard?)
    – sr_
    Apr 25, 2012 at 11:23
  • 2
    Adding this line to /etc/rsyslog.conf worked with rsyslogd 8.4.2
    – ztk
    Jul 21, 2016 at 21:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .