Concepts / Monitoring

Monitoring

Facility and severity

Also called PRI, log level, syslog priority, local0, warning, debug

The two numbers that sort a syslog message: what kind of program sent it, and how bad it is.

Facilities: 0 kern, 1 user, 3 daemon, 4 auth, 16 to 23 local0 to local7. Severities run from 0 emerg to 7 debug, lower being worse; "warning and worse" is 4 or lower. Senders and collectors filter on both (*.warning, auth.*). Severity is the sender's opinion: a real problem logged as info passes every filter unnoticed.

See it on real machines

Learn it on real machines.

Every lab is a small network of real Linux machines in your browser. Start with a free account: Google or email, no card.

Open this lab