Every syslog message carries a facility (what kind of thing produced it) and a severity (how important it is). Together they form the priority.
Severities (priority levels)¶
| Code | Keyword | Meaning | Typical use |
|---|---|---|---|
| 0 | emerg |
System is unusable | Kernel panic imminent |
| 1 | alert |
Action must be taken immediately | Corrupted system database |
| 2 | crit |
Critical condition | Hardware failure |
| 3 | err |
Error condition | Service failed to start |
| 4 | warning |
Warning condition | Disk 90% full |
| 5 | notice |
Normal but significant | Service reloaded config |
| 6 | info |
Informational | Connection accepted |
| 7 | debug |
Debug-level messages | Verbose troubleshooting |
Deprecated synonyms you'll still see in old configs: panic (= emerg), error (= err), warn (= warning).
Facilities¶
| Code | Keyword | Source |
|---|---|---|
| 0 | kern |
Kernel (cannot be sent from userspace via syslog(3)) |
| 1 | user |
Generic user-level messages (default for logger) |
| 2 | mail |
Mail system |
| 3 | daemon |
System daemons without their own facility |
| 4 | auth |
Security / authorization |
| 5 | syslog |
Messages generated by the syslog daemon itself |
| 6 | lpr |
Printing |
| 7 | news |
Usenet |
| 8 | uucp |
UUCP |
| 9 | cron |
cron / at |
| 10 | authpriv |
Private security/auth messages (sudo, sshd, PAM) |
| 11 | ftp |
FTP daemon |
| 12–15 | ntp, security, console, clock |
Rarely used directly |
| 16–23 | local0 … local7 |
Free for your own use (network gear, apps, HAProxy, etc.) |
The on-the-wire PRI value is facility × 8 + severity. For example, authpriv.crit = 10 × 8 + 2 = <82>.
Assign local0–local7 deliberately and document it (e.g. local0 = HAProxy, local4 = network switches) so you can route them cleanly on a central server.
Message formats¶
RFC 3164 ("BSD syslog"), still the most common on the wire and in files:
<34>Oct 9 22:14:15 web01 sshd[1234]: Accepted publickey for andrew from 192.0.2.50
No year, no timezone, second precision. Fine for a single host, painful at scale.
RFC 5424 (structured syslog):
<34>1 2026-10-09T22:14:15.003412-04:00 web01.example.com sshd 1234 - - Accepted publickey for andrew
Full ISO 8601 timestamp with sub-second precision and offset, plus optional structured-data elements. Prefer RFC 5424 (or RFC 3339 timestamps in files) whenever you aggregate logs from multiple hosts. See High-precision timestamps.