Which program defaults uses syslog local[0-7] facilities?

by

The LOCALn facilities are available for any local use and can vary pretty widely from site to site.

I guarantee every one of the 8 available are used by something, so if you want to avoid conflicts my best advice is to log all 7 to separate logs and pick the one that nothing else seems to be using.

Some you missed (program defaults – may be changed locally so double-check):

  • LOCAL0 is used by postgresql (if configured to log to syslog)
  • LOCAL2 is used by sudo (if configured to log to syslog)
  • LOCAL3 is used by some versions of SpamAssassin
    • This is often changed by the local admin to log to mail instead
  • LOCAL5 is sometimes used by the Snort IDS
    • I don’t know if this is a default or just coincidence, but I’ve seen it on several Snort installations

Leave a Comment