As defined by the syslog protocol, facility identifies the sub-system that generates a log. The values local use 0-local use 7 are user-defined. The log generated by a switch can be specified by facility. By default, local 7 is used.
| Numerical Code |
Facility |
|---|
| 0 |
kernel messages |
| 1 |
user-level messages |
| 2 |
mail system |
| 3 |
system daemons |
| 4 |
security/authorization messages (note 1) |
| 5 |
messages generated internally by syslogd |
| 6 |
line printer subsystem |
| 7 |
network news subsystem |
| 8 |
UUCP subsystem |
| 9 |
clock daemon (note 2) |
| 10 |
security/authorization messages (note 1) |
| 11 |
FTP daemon |
| 12 |
NTP subsystem |
| 13 |
log audit (note 1) |
| 14 |
log alert (note 1) |
| 15 |
clock daemon (note 2) |
| 16 |
local use 0 (local0) |
| 17 |
local use 1 (local1) |
| 18 |
local use 2 (local2) |
| 19 |
local use 3 (local3) |
| 20 |
local use 4 (local4) |
| 21 |
local use 5 (local5) |
| 22 |
local use 6 (local6) |
| 23 |
local use 7 (local7) |