Well, that is probably because the host where syslog-ng was compiled is a different OS than that where the "audit" facility log line was created.

For instance, on a Linux host, the syslog.h file from the system only has these facilities defined.

CODE facilitynames[] =
{
    { "auth", LOG_AUTH },
    { "authpriv", LOG_AUTHPRIV },
    { "cron", LOG_CRON },
    { "daemon", LOG_DAEMON },
    { "ftp", LOG_FTP },
    { "kern", LOG_KERN },
    { "lpr", LOG_LPR },
    { "mail", LOG_MAIL },
    { "mark", INTERNAL_MARK },          /* INTERNAL */
    { "news", LOG_NEWS },
    { "security", LOG_AUTH },           /* DEPRECATED */
    { "syslog", LOG_SYSLOG },
    { "user", LOG_USER },
    { "uucp", LOG_UUCP },
    { "local0", LOG_LOCAL0 },
    { "local1", LOG_LOCAL1 },
    { "local2", LOG_LOCAL2 },
    { "local3", LOG_LOCAL3 },
    { "local4", LOG_LOCAL4 },
    { "local5", LOG_LOCAL5 },
    { "local6", LOG_LOCAL6 },
    { "local7", LOG_LOCAL7 },

with values of

/* facility codes */
#define LOG_KERN        (0<<3) /* kernel messages */
#define LOG_USER        (1<<3) /* random user-level messages */
#define LOG_MAIL        (2<<3) /* mail system */
#define LOG_DAEMON      (3<<3) /* system daemons */
#define LOG_AUTH        (4<<3) /* security/authorization messages */
#define LOG_SYSLOG      (5<<3) /* messages generated internally by syslogd */
#define LOG_LPR         (6<<3) /* line printer subsystem */
#define LOG_NEWS        (7<<3) /* network news subsystem */
#define LOG_UUCP        (8<<3) /* UUCP subsystem */
#define LOG_CRON        (9<<3) /* clock daemon */
#define LOG_AUTHPRIV    (10<<3) /* security/authorization messages (private) */
#define LOG_FTP         (11<<3) /* ftp daemon */

        /* other codes through 15 reserved for system use */
#define LOG_LOCAL0      (16<<3) /* reserved for local use */
#define LOG_LOCAL1      (17<<3) /* reserved for local use */
#define LOG_LOCAL2      (18<<3) /* reserved for local use */
#define LOG_LOCAL3      (19<<3) /* reserved for local use */
#define LOG_LOCAL4      (20<<3) /* reserved for local use */
#define LOG_LOCAL5      (21<<3) /* reserved for local use */
#define LOG_LOCAL6      (22<<3) /* reserved for local use */
#define LOG_LOCAL7      (23<<3) /* reserved for local use */

so there is no audit facility.

Hope that explains it.

On 07/28/2015 09:08 AM, Justin Kala wrote: