Syslog facilities and priorities¶

Synopsis¶

<PRI>          PRI = facility code × 8 + severity code
selector       facility[,facility…].[=|!|!=]severity[;selector…]
rule           selector  action
logger         logger [-p facility.severity] [-t tag] [message]

Description¶

Every syslog message carries a priority made of two parts: a facility, the kind of program that sent it, and a severity, how important it is. On the wire and on the /dev/log socket, both are encoded in one number, the PRI value, written in angle brackets at the start of the message: <PRI> = facility × 8 + severity. For example, <11> is facility user (1) and severity err (3), since 1 × 8 + 3 = 11.

Syslog daemons route messages to files, users, programs and remote servers by matching their facility and severity against selectors. The systemd journal stores both values as fields (SYSLOG_FACILITY and PRIORITY) and can filter on them with journalctl --facility and journalctl -p.

The codes are defined in RFC 5424 and in <syslog.h>. Checked against rsyslog 8.2504.0 on Debian 13 (installed from the repository), 8.2512.0 on Ubuntu 26.04 and 8.2510.0 on AlmaLinux 10 and Rocky Linux 10; syslog-ng 4.12.0 on Arch (installed from the repository); sysklogd 2.7.2 and rsyslog 8.2608.0 on Gentoo; and logger from util-linux 2.40.2 to 2.42.4 (November 2026).

Facilities¶

Code	Name	Used by
0	`kern`	The kernel. User programs can't log with this facility through the C library.
1	`user`	User programs; the default for programs that don't choose a facility, and for `logger`
2	`mail`	Mail servers and agents
3	`daemon`	System daemons without a facility of their own; also the default for output of systemd services
4	`auth`	Security and authorisation messages
5	`syslog`	Messages generated by the syslog daemon itself
6	`lpr`	Printing subsystem
7	`news`	Network news (NNTP)
8	`uucp`	UUCP
9	`cron`	`cron` and `at`
10	`authpriv`	Private security and authorisation messages, such as from `sshd`, `sudo` and PAM
11	`ftp`	FTP servers
12–15	(no name)	Defined by RFC 5424 for NTP, log audit, log alert and a second clock daemon; the GNU C library has no names for them, and `journalctl --facility=help` lists them as numbers
16–23	`local0` … `local7`	Reserved for local use: assign them to your own applications and devices

Severities¶

Listed from most to least severe. A selector with a severity matches that severity and every more severe one, unless it uses =.

Code	Name	Obsolete synonym	Meaning
0	`emerg`	`panic`	The system is unusable
1	`alert`		Action must be taken immediately
2	`crit`		Critical conditions, such as hardware errors
3	`err`	`error`	Error conditions
4	`warning`	`warn`	Warning conditions
5	`notice`		Normal but significant conditions
6	`info`		Informational messages
7	`debug`		Debugging messages

journalctl -p takes the same names or codes. Output that systemd services write to standard output or standard error is stored with severity info and facility daemon, unless a line starts with a <N> prefix giving another severity, or the unit sets SyslogLevel= or SyslogFacility=.

Selector syntax¶

The traditional selector syntax is shared by sysklogd's /etc/syslog.conf and rsyslog's configuration, where it may be followed by an action in either the legacy or the action(...) syntax. syslog-ng uses its own filter functions instead (see syslog-ng).

Selector	Matches
`mail.err`	Facility `mail`, severity `err` or more severe
`mail.=err`	Facility `mail`, severity `err` only
`mail.!err`	Facility `mail`, severities less severe than `err` (`warning` to `debug`)
`mail.!=err`	Facility `mail`, every severity except `err`
`mail.*`	Facility `mail`, every severity
`*.err`	Every facility, `err` or more severe
`.`	Every message
`mail.none`	No message of facility `mail` (used after `;` to exclude)
`auth,authpriv.*`	Facilities `auth` and `authpriv`, every severity
`.;auth,authpriv.none`	Every message except those of `auth` and `authpriv`
`.=info;.=notice;*.=warn`	Severities `info`, `notice` and `warning` only, of every facility

Selectors separated by ; apply to the same action and are evaluated from left to right; a later selector can remove what an earlier one added.
In a comma-separated facility list, the severity applies to every facility listed.
A rule can span several lines if each line but the last ends with \.
Fields are separated by spaces or tabs.

Actions¶

Action	sysklogd	rsyslog (legacy syntax)	Effect
`/var/log/FILE`	yes	yes	Append to the file
`-/var/log/FILE`	yes	accepted	Don't sync the file after each message (rsyslog doesn't sync by default anyway)
`\\|/path/to/fifo`	yes	yes	Write to a named pipe
`@HOST[:PORT]`	yes	yes	Forward over UDP (port 514 by default)
`@@HOST[:PORT]`	no	yes	Forward over TCP
`*`	yes		Write to every logged-in user's terminal
`:omusrmsg:*`		yes	Write to every logged-in user's terminal
`stop`		yes	Discard the message; no later rule sees it

In rsyslog, the equivalent action() statement is action(type="omfile" file="/var/log/FILE"), action(type="omfwd" target="HOST" port="514" protocol="tcp") and so on.

Other filters¶

Daemon	Filter	Example
sysklogd	Program block: rules after `!PROG` apply to that program only; `!*` resets	`!sshd`
sysklogd	Host block: rules after `+HOST` apply to messages from that host	`+@` (this host)
sysklogd, rsyslog	Property filter: `:PROPERTY, [!]OPERATOR, "VALUE"`	`:msg, contains, "[UFW "`
rsyslog	Expression filter	`if $programname == "sshd" then /var/log/sshd.log`

Default rules¶

The rules each distribution family ships with, as found on the lab images. Only one syslog daemon is installed on each system, if any.

Debian/UbuntuRHEL/Alma/RockyArchGentoo

Ubuntu 26.04 installs rsyslog, which receives messages from the journal through its imuxsock input (journald runs with ForwardToSyslog=yes). Rules in /etc/rsyslog.d/50-default.conf:

auth,authpriv.*                 /var/log/auth.log
*.*;auth,authpriv.none          -/var/log/syslog
kern.*                          -/var/log/kern.log
mail.*                          -/var/log/mail.log
mail.err                        /var/log/mail.err
*.emerg                         :omusrmsg:*

/etc/rsyslog.d/20-ufw.conf sends firewall messages to /var/log/ufw.log, and 21-cloudinit.conf sends cloud-init's messages to /var/log/cloud-init.log.

Debian 13 doesn't install a syslog daemon by default (rsyslog is optional); messages are kept in the journal only. Once rsyslog is installed, its rules are in /etc/rsyslog.conf:

*.*;auth,authpriv.none          -/var/log/syslog
auth,authpriv.*                 /var/log/auth.log
cron.*                          -/var/log/cron.log
kern.*                          -/var/log/kern.log
mail.*                          -/var/log/mail.log
user.*                          -/var/log/user.log
*.emerg                         :omusrmsg:*

rsyslog is installed and reads messages from the journal through its imjournal input; its own /dev/log socket input is turned off (SysSock.Use="off"). Rules in /etc/rsyslog.conf:

*.info;mail.none;authpriv.none;cron.none    /var/log/messages
authpriv.*                                  /var/log/secure
mail.*                                      -/var/log/maillog
cron.*                                      /var/log/cron
*.emerg                                     :omusrmsg:*
uucp,news.crit                              /var/log/spooler
local7.*                                    /var/log/boot.log

(The file writes these in the action(type="omfile" …) syntax; they're shown here in the equivalent short form.)

No syslog daemon is installed; messages are kept in the journal only. The syslog-ng package's /etc/syslog-ng/syslog-ng.conf defines a source s_local (the journal and syslog-ng's own messages), many filters and file destinations, but its log paths have their destinations commented out, so it writes no files until you enable them.

Gentoo leaves the choice of syslog daemon to the administrator; the lab uses sysklogd, which reads /dev/log and the kernel log itself. The package's rules in /etc/syslog.conf:

auth,authpriv.*                 /var/log/auth.log
*.*;auth,authpriv.none          -/var/log/syslog
kern.*                          -/var/log/kern.log
mail.*                          -/var/log/mail.log
mail.err                        /var/log/mail.err
*.=info;*.=notice;*.=warn;\
    auth,authpriv.none;\
    cron,daemon.none;\
    mail,news.none              -/var/log/messages
*.=emerg                        *

The file also sets secure_mode 1 and includes /etc/syslog.d/*.conf. /etc/conf.d/sysklogd starts the daemon with -m 0 -s -s -r 10M:10: no periodic -- MARK -- messages, no network sockets at all (the second -s, which overrides secure_mode in the file and also prevents forwarding), and built-in rotation of every file at 10 MiB.

If app-admin/rsyslog is installed instead, its rules are in /etc/rsyslog.d/50-default.conf: one file per facility (auth.log, cron.log, daemon.log, kern.log, lpr.log, mail.log, news.log, user.log), debug.log for debug messages, and /var/log/messages for info and above from the remaining facilities.

syslog-ng filters¶

syslog-ng selects messages with filter functions inside filter blocks, combined with and, or and not, and connects sources, filters and destinations in log paths:

Function	Matches
`facility(auth, authpriv)`	The listed facilities
`level(err..emerg)`	A severity, or a range of severities
`program("sshd")`	The program name
`host("web1")`	The sending host's name
`match("text" value("MESSAGE"))`	A regular expression on a field

logger¶

logger [OPTIONS] [MESSAGE…]

logger writes a message to the system log, from its arguments, from standard input, or from a file.

Option	Effect
`-p, --priority FACILITY.SEVERITY`	Priority of the message, by name or number; default `user.notice`
`-t, --tag TAG`	Tag (program name) to log under; default the name of the user running `logger`
`-i`, `--id[=ID]`	Include the `logger` process ID, or the given ID
`-f, --file FILE`	Log each line of the file
`-e, --skip-empty`	Don't log empty lines when reading a file or standard input
`-s, --stderr`	Also write the message to standard error
`-n, --server HOST`	Send to a remote syslog server instead of the local socket
`-P, --port PORT`	Port for `--server`
`-T, --tcp` / `-d, --udp`	Use TCP only / UDP only with `--server`
`--rfc3164` / `--rfc5424`	Message format: the BSD syslog format, or the syslog protocol (the default for remote servers)
`-u, --socket SOCKET`	Write to this Unix socket instead of `/dev/log`
`--journald[=FILE]`	Write a structured entry directly to the journal, with fields read from standard input or the file

Examples:

logger "backup finished"
logger -t backup -p local0.err "backup failed: no space left on device"
logger -n 192.0.2.10 -T -P 514 -t test "sent straight to a remote server over TCP"
printf 'MESSAGE=deploy finished\nRELEASE=4.2\n' | logger --journald

Files¶

Path	Purpose
`/dev/log`	Local syslog socket; on systemd systems a link to `/run/systemd/journal/dev-log`, owned by journald
`/etc/rsyslog.conf`, `/etc/rsyslog.d/*.conf`	rsyslog configuration
`/etc/syslog.conf`, `/etc/syslog.d/*.conf`	sysklogd configuration
`/etc/conf.d/sysklogd`, `/etc/conf.d/rsyslog`	Gentoo: daemon command-line options for OpenRC
`/etc/syslog-ng/syslog-ng.conf`	syslog-ng configuration