syslog协议的Facility, Severity数字代号和PRI计算
一条syslog信息包含三部分，PRI, HEADER和MSG，其中PRI是<>扩起来的一个数字，这个数字就代表了不同Facility和Severity的消息。
其中Facility, Severity的数字代号列表如下：
Facility:
| Code | Keyword | Description |
|---|---|---|
| 0 | kern | kernel messages |
| 1 | user | user-level messages |
| 2 | mail system | |
| 3 | daemon | system daemons |
| 4 | auth | security/authorization messages |
| 5 | syslog | messages generated internally by syslogd |
| 6 | lpr | line printer subsystem (archaic subsystem) |
| 7 | news | network news subsystem (archaic subsystem) |
| 8 | uucp | UUCP subsystem (archaic subsystem) |
| 9 | clock daemon | |
| 10 | authpriv | security/authorization messages |
| 11 | ftp | FTP daemon |
| 12 | - | NTP subsystem |
| 13 | - | log audit |
| 14 | - | log alert |
| 15 | cron | scheduling daemon |
| 16 | local0 | local use 0 (local0) |
| 17 | local1 | local use 1 (local1) |
| 18 | local2 | local use 2 (local2) |
| 19 | local3 | local use 3 (local3) |
| 20 | local4 | local use 4 (local4) |
| 21 | local5 | local use 5 (local5) |
| 22 | local6 | local use 6 (local6) |
| 23 | local7 | local use 7 (local7) |
Severity:
| Code | Keyword | Description |
|---|---|---|
| 0 | emerg | System is unusable |
| 1 | alert | Should be corrected immediately |
| 2 | crit | Critical conditions |
| 3 | err | Error conditions |
| 4 | warning | May indicate that an error will occur if action is not taken. |
| 5 | notice | Events that are unusual, but not error conditions. |
| 6 | info | Normal operational messages that require no action. |
| 7 | debug | Information useful to developers for debugging the application. |
针对PRI的计算公式：PRI = FacilityCode*8 + SeverityCode
举个例子： local3.info的日志，它的PRI就是19*8+6=158，所以这条消息在传输中的格式为<158> {HEADER} {MEG}
再一个例子，如果看到一条PRI为14的消息，那么它实际的级别就是user.info (1*8+6=14)
参考：