Unix & Linux: What is the local6 (and all other local#) facilities in syslog? (2 Solutions!!)
Channel: Roel Van de Paar
Date: 2020-08-14

Unix & Linux: What is the local6 (and all other local#) facilities in syslog?


The Question: ***** What I understand *****
On *nix servers, we configure sending logs using facility.severity, where
facility is the name of the (let's call it) "component" of the system, such as
kernel, authentication, and so on; and severity is the "level" of each of the
logs logged by a facility, such as info (informational), crit (critical) logs.
So, if I want to send kernel critical logs, I'll use kern.crit.
The combination of facility and severity is known as the priority, for
example...
 * priority = kern.crit
 * facility = kern
 * severity = crit
***** Question *****
There are "facilities" called local0 to local7.
What in the world are these local# facilities? I'm asking specifically about
local6, since it's usually the most common one I find in searches.
My question is actually because I'm configuring Snort (SourceFire Intrusion
Sensor) to send logs, so I wanted to know which facility to use. My question is
not Snort specific though, because local# facilities are everywhere; on Cisco
and IBM's WebSphere Application Server for instance.
***** Research *****
 * RFC3164, which is where the syslog protocol is defined, only says:
 local6 - local use 6
 Which doesn't really describe it, as opposed to:
 auth - security/authorization messages
 * In Ubuntu, man syslog shows:
 LOG_LOCAL0 through LOG_LOCAL7
 reserved for local use
 Also, vague.

Solutions: Please watch the whole video to see all solutions, in order of how many people found them helpful

== This solution helped 7 people ==
Local# facilities are dedicated for local use and there is not any standard
defined (like RFC) which one is used by which application. So you can choose
whatever you want. Of course, some applications and their developers agreed on
a particular facility to use but this is not an official standard (like sudo -
LOCAL2, Snort - LOCAL5, ...).

With thanks & praise to God, and with thanks to the many people who have made this project possible! | Content (except music & images) licensed under cc by-sa 3.0 | Music: https://www.bensound.com/royalty-free-music | Images: https://stocksnap.io/license & others | With thanks to user JungleMartin (https://unix.stackexchange.com/users/83833), user dsmsk80 (https://unix.stackexchange.com/users/44625), user Alaa Ali (https://unix.stackexchange.com/users/38128), and the Stack Exchange Network (http://unix.stackexchange.com/questions/90842). Trademarks are property of their respective owners. Disclaimer: All information is provided "AS IS" without warranty of any kind. You are responsible for your own actions. Please contact me if anything is amiss at Roel D.OT VandePaar A.T gmail.com.