syslog protocol explained

syslog is a protocol for tracking and logging system messages in Linux. Applications use syslog to export all their error and status messages to the files in the /var/log directory.

syslog uses the client-server model; a client transmits a text message to the server (receiver). The server is commonly called syslogd, syslog daemon, or syslog server. syslog uses the User Datagram Protocol (UDP) port 514 for communication. The messages are sent in cleartext, although an SSL wrapper can be used to provide encryption.

Each message sent to the syslog server has two labels associated with it that make the message easier to handle. The first label describes the function (facility) of the application that generated it. For example, mail servers typically log using the mail facility. The second label specifies the severity level. After these two labels, the action in specified. The action is usually a filename in the /var/log directory tree, in which the messages will be stored:

facility.priority  action

Here is a list of facilities available:

NumberKeywordFacility description
0kernkernel messages
1useruser-level messages
2mailmail system
3daemonsystem daemons
4authsecurity/authorization messages
5syslogmessages generated internally by syslogd
6lprline printer subsystem
7newsnetwork news subsystem
8uucpUUCP subsystem
9clock daemon
10authprivsecurity/authorization messages
11ftpFTP daemon
12NTP subsystem
13log audit
14log alert
15cronclock daemon
16local0local use 0 (local0)
17local1local use 1 (local1)
18local2local use 2 (local2)
19local3local use 3 (local3)
20local4local use 4 (local4)
21local5local use 5 (local5)
22local6local use 6 (local6)
23local7local use 7 (local7)


Here is a list of severity levels:

0Emergencyemerg (panic)System is unusable.
1AlertalertAction must be taken immediately.
2CriticalcritCritical conditions.
3Errorerr (error)Error conditions.
4Warningwarning (warn)Warning conditions.
5NoticenoticeNormal but significant condition.
6InformationalinfoInformational messages.
7DebugdebugDebug-level messages.


Note that, when you specify a priority, you are actually specifying everything at that priority or higher. For example, would mean all messages coming from the mail facility with the info, notice, warning, err, crit, alert or emerg priority.

Subscribe to our Newsletter

Like us on Facebook

Geek University 2019