syslog local facilities

[ron.peterson at yellowbank.com (Ron Peterson)]

Huy M Le wrote:
> 
> syslog local log facilities are reserved for local usage, based on the
> linux man pages.  My understanding is that these local log facilities can
> not be utilized by any remote machines.  Am I currectly understanding?
> Would someone please clearify this?  Also, there are 8 local log levels
> running from local0 to local7; i found one discussion one the web stated
> that local7 is for kernel messages.  What each of other local log
> facilities are for? I greatly appreciate any helps.

I'm no expert at syslogd configuration, but I'll take a stab at this.

You configure syslog to respond to a combination of facility.loglevel,
where 'facility' basically refers to the type of application, and
loglevel corresponds to severity.  local0-local7, along with more
specific facilities like mail, kern, auth, lpr - refer to the type of
application.  There are nine predefined facilities, plus these eight
locally defined facilities.  I.E. - your application might not
correspond to one of the nine predefined types, so you could elect to
use the local facilities.  (I could be wrong about this, but that's been
my understanding).

Kernel messages, then, belong to the 'kern' facility.  If you wanted to
log all kernel messages, put a line like 'kern.* /var/log/kernlog' in
your syslog.conf.  And make sure you rotate your logs frequently... ;)

Your syslog daemon can accept remotely generated syslog messages if you
start it with the -r option.  I log local7 messages from a Cisco VPN
5000 on a linux box this way, for example.

-Ron-
-
Subcription/unsubscription/info requests: send e-mail with
"subscribe", "unsubscribe", or "info" on the first line of the
message body to discuss-request at blu.org (Subject line is ignored).