Adding a new facility to syslog

Question

The docs give a fixed list of facilties for syslog, but it's clearly possible to have more (http isn't on the list). Do I just describe it in the conf file and start using it or is is more involved? (It's an ecommerce system and I want to log the payment activities better.)

Answer 1

The syslog protocol only allows the predefined facilities defined in RFC 3164. Most (if not all) syslog daemons will process messages with different facility identifiers as corrupt.

But you can easily use the facilities local0 through local7 for your custom logging needs, which is what they are there for.

Answer 2

AFAIK, you cannot. You probably want to take a look at the filter function of rsyslog or syslog-ng.

Answer 3

You can use a filter function in the aforementioned tools. You can also use a syslog manager such as LogZilla to filter search and graph results based on facility.