What I understand
On *nix servers, we configure sending logs using
facility is the name of the (let's call it) "component" of the system, such as kernel, authentication, and so on; and
severity is the "level" of each of the logs logged by a facility, such as
crit (critical) logs.
So, if I want to send kernel critical logs, I'll use
The combination of facility and severity is known as the priority, for example...
- priority = kern.crit
- facility = kern
- severity = crit
There are "facilities" called
What in the world are these
local# facilities? I'm asking specifically about
local6, since it's usually the most common one I find in searches.
My question is actually because I'm configuring Snort (SourceFire Intrusion Sensor) to send logs, so I wanted to know which
facility to use. My question is not Snort specific though, because
local# facilities are everywhere; on Cisco and IBM's WebSphere Application Server for instance.
RFC3164, which is where the syslog protocol is defined, only says:
local6 - local use 6
Which doesn't really describe it, as opposed to:
auth - security/authorization messages
LOG_LOCAL0 through LOG_LOCAL7 reserved for local use