syslog protocol explained

syslog is a protocol for tracking and logging system messages in Linux. Applications use syslog to export all their error and status messages to the files in the /var/log directory.

syslog uses the client-server model; a client transmits a text message to the server (receiver). The server is commonly called syslogd, syslog daemon, or syslog server. syslog uses the User Datagram Protocol (UDP) port 514 for communication. The messages are sent in cleartext, although an SSL wrapper can be used to provide encryption.

Each message sent to the syslog server has two labels associated with it that make the message easier to handle. The first label describes the function (facility) of the application that generated it. For example, mail servers typically log using the mail facility. The second label specifies the severity level. After these two labels, the action in specified. The action is usually a filename in the /var/log directory tree, in which the messages will be stored:

facility.priority  action

Here is a list of facilities available:

Here is a list of severity levels:

Note that, when you specify a priority, you are actually specifying everything at that priority or higher. For example, mail.info would mean all messages coming from the mail facility with the info, notice, warning, err, crit, alert or emerg priority.