0

What are the things one should consider when setting the facility for a syslog client? In particular is there a difference between "4 security/authorization messages" and "10 security/authorization messages"?

I'm configuring a DataPower XS40 appliance.

1

The way I understand it, 4 is for general authorization messages, and 10 is for "sensitive" messages. Generally it seems like logins/changes/sudo to the local machine end up facility 10, and remote stuff like IMAP/POP logins/out seem to end up in 4. YMMV depending on what OS the syslog stream ends up.

http://www.syslog.org/forum/syslog-and-syslogd/what-is-difference-between-syslog-facility-auth-and-authpr/

Mark

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy