Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

What are the things one should consider when setting the facility for a syslog client? In particular is there a difference between "4 security/authorization messages" and "10 security/authorization messages"?

I'm configuring a DataPower XS40 appliance.

share|improve this question
add comment

1 Answer

The way I understand it, 4 is for general authorization messages, and 10 is for "sensitive" messages. Generally it seems like logins/changes/sudo to the local machine end up facility 10, and remote stuff like IMAP/POP logins/out seem to end up in 4. YMMV depending on what OS the syslog stream ends up.

http://www.syslog.org/forum/syslog-and-syslogd/what-is-difference-between-syslog-facility-auth-and-authpr/

Mark

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.