<div dir="ltr"><br><div>Curious about opinions on syslog facilities, specifically when your [r]syslog server is set up to accept logs from remote sources. Says the RFC, the enumerated facilities are:</div><div><br></div><div>
<pre class="" style="font-size:1em;margin-top:0px;margin-bottom:0px;color:rgb(0,0,0)"> 0 kernel messages
1 user-level messages
2 mail system
3 system daemons
4 security/authorization messages
5 messages generated internally by syslogd
6 line printer subsystem
7 network news subsystem
8 UUCP subsystem
9 clock daemon
10 security/authorization messages
11 FTP daemon
12 NTP subsystem
13 log audit
14 log alert
15 clock daemon (note 2)
16 local use 0 (local0)
17 local use 1 (local1)
18 local use 2 (local2)
19 local use 3 (local3)
20 local use 4 (local4)
21 local use 5 (local5)
22 local use 6 (local6)
23 local use 7 (local7)</pre><pre class="" style="font-size:1em;margin-top:0px;margin-bottom:0px;color:rgb(0,0,0)"><br></pre><pre class="" style="font-size:1em;margin-top:0px;margin-bottom:0px;color:rgb(0,0,0)">
<span style="color:rgb(34,34,34);font-family:arial;font-size:small;white-space:normal">I realize the names are just labels, but I like to do things correctly and not just make it up as I go along. I want, as much as possible, the next guy who comes after me not to scratch his head wondering what kind of nonsense I came up with.</span></pre>
<pre class="" style="font-size:1em;margin-top:0px;margin-bottom:0px;color:rgb(0,0,0)"><span style="color:rgb(34,34,34);font-family:arial;font-size:small;white-space:normal"><br></span></pre><pre class="" style="font-size:1em;margin-top:0px;margin-bottom:0px;color:rgb(0,0,0)">
<span style="color:rgb(34,34,34);font-family:arial;font-size:small;white-space:normal">If you're using a syslog server (for example) to accept HTTP access logs from load balancers, which facility is the "correct" one? We're using local0 right now, but that feels kind of hack-ish because local is supposed to be for local stuff, not remote stuff?</span><br>
</pre><pre class="" style="font-size:1em;margin-top:0px;margin-bottom:0px;color:rgb(0,0,0)"><span style="color:rgb(34,34,34);font-family:arial;font-size:small;white-space:normal"><br></span></pre><pre class="" style="font-size:1em;margin-top:0px;margin-bottom:0px;color:rgb(0,0,0)">
<span style="color:rgb(34,34,34);font-family:arial;font-size:small;white-space:normal">What is the convention for choosing a facility to handle remote logs?</span></pre></div></div>