[syslog-ng] priority and facility gone when using template for remote logging

[Nate Campi]

On Wed, Jun 21, 2006 at 02:27:39PM +0200, Wolfram Schlich wrote:
> Ah, this is the syslog remote logging protocol format?
> Why is there only PRI inside <>? What about the facility?
> Is it <FAC.PRI>?

The facility/severity is derived from a single decimal number called the
PRI. See http://www.faqs.org/rfcs/rfc3164.html

4.1.1 PRI Part

   The PRI part MUST have three, four, or five characters and will be
   bound with angle brackets as the first and last characters.  The PRI
   part starts with a leading "<" ('less-than' character), followed by a
   number, which is followed by a ">" ('greater-than' character). The
   code set used in this part MUST be seven-bit ASCII in an eight-bit
   field as described in RFC 2234 [2].  These are the ASCII codes as
   defined in "USA Standard Code for Information Interchange" [3].  In
   this, the "<" character is defined as the Augmented Backus-Naur Form
   (ABNF) %d60, and the ">" character has ABNF value %d62.  The number
   contained within these angle brackets is known as the Priority value
   and represents both the Facility and Severity as described below.
   The Priority value consists of one, two, or three decimal integers
   (ABNF DIGITS) using values of %d48 (for "0") through %d57 (for "9").

   The Facilities and Severities of the messages are numerically coded
   with decimal values.  Some of the operating system daemons and
   processes have been assigned Facility values.  Processes and daemons
   that have not been explicitly assigned a Facility may use any of the
   "local use" facilities or they may use the "user-level" Facility.
   Those Facilities that have been designated are shown in the following
   table along with their numerical code values.

       Numerical             Facility
          Code

           0             kernel messages
           1             user-level messages
           2             mail system
           3             system daemons
           4             security/authorization messages (note 1)

           5             messages generated internally by syslogd
           6             line printer subsystem
           7             network news subsystem
           8             UUCP subsystem
           9             clock daemon (note 2)
          10             security/authorization messages (note 1)
          11             FTP daemon
          12             NTP subsystem
          13             log audit (note 1)
          14             log alert (note 1)
          15             clock daemon (note 2)
          16             local use 0  (local0)
          17             local use 1  (local1)
          18             local use 2  (local2)
          19             local use 3  (local3)
          20             local use 4  (local4)
          21             local use 5  (local5)
          22             local use 6  (local6)
          23             local use 7  (local7)

           Table 1.  syslog Message Facilities

        Note 1 - Various operating systems have been found to utilize
           Facilities 4, 10, 13 and 14 for security/authorization,
           audit, and alert messages which seem to be similar.
        Note 2 - Various operating systems have been found to utilize
           both Facilities 9 and 15 for clock (cron/at) messages.

   Each message Priority also has a decimal Severity level indicator.
   These are described in the following table along with their numerical
   values.

        Numerical         Severity
          Code

           0       Emergency: system is unusable
           1       Alert: action must be taken immediately
           2       Critical: critical conditions
           3       Error: error conditions
           4       Warning: warning conditions
           5       Notice: normal but significant condition
           6       Informational: informational messages
           7       Debug: debug-level messages

           Table 2. syslog Message Severities

   The Priority value is calculated by first multiplying the Facility
   number by 8 and then adding the numerical value of the Severity. For
   example, a kernel message (Facility=0) with a Severity of Emergency
   (Severity=0) would have a Priority value of 0.  Also, a "local use 4"
   message (Facility=20) with a Severity of Notice (Severity=5) would
   have a Priority value of 165.  In the PRI part of a syslog message,
   these values would be placed between the angle brackets as <0> and
   <165> respectively.  The only time a value of "0" will follow the "<"
   is for the Priority value of "0". Otherwise, leading "0"s MUST NOT be
   used.

-- 
Nate

"They spell it Vinci and pronounce it Vinchy; foreigners always spell 
better than they pronounce." - Innocents Abroad - Samuel Clemens