Monitoring
Facility and severity
The two numbers that sort a syslog message: what kind of program sent it, and how bad it is.
Facilities: 0 kern, 1 user, 3 daemon, 4 auth, 16 to 23 local0 to local7. Severities run
from 0 emerg to 7 debug, lower being worse; "warning and worse" is 4 or lower. Senders and collectors filter on
both (*.warning, auth.*). Severity is the sender's opinion: a real problem logged as info passes every
filter unnoticed.