Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What are the things one should consider when setting the facility for a syslog client? In particular is there a difference between "4 security/authorization messages" and "10 security/authorization messages"?

I'm configuring a DataPower XS40 appliance.

share|improve this question

The way I understand it, 4 is for general authorization messages, and 10 is for "sensitive" messages. Generally it seems like logins/changes/sudo to the local machine end up facility 10, and remote stuff like IMAP/POP logins/out seem to end up in 4. YMMV depending on what OS the syslog stream ends up.


share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.