FYI, here is the definition from RFC3164: 0 Emergency: system is unusable 1 Alert: action must be taken immediately 2 Critical: critical conditions 3 Error: error conditions 4 Warning: warning conditions 5 Notice: normal but significant condition 6 Informational: informational messages 7 Debug: debug-level messages The explanations for critical, error and warning are not exactly stellar. At least it clarifies, that critical does *not* require immediate action as does an alert. Other systems (and the english language?) would have it the other way around. Anyway, within the syslog system we should stick to syslog-speak. And yes, it makes sense to think carefully about assigning severities. And no, they should not change once rolled out. Just my 2c, Peter Klausner