Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an application (in java) running in a Windows PC and I want to send logging messages to a syslog server running in a Linux box somewhere in the network.
The problem I have is, that it is not clear to me what should I use as facility in this case.
I.e. can I (/should I) send the logging info as one of LOCAL0-LOCAL7?
Or are they not supposed to be used by remote applications? It is not clear to me if they are usable or not.
Should I use USER instead?

Could anyone help me on this please?

share|improve this question
up vote 0 down vote accepted

When your application matches one of the predefined facilities well, you should use it (e.g. when you have a mailserver, use mail). For most custom apps however it makes more sense to use one (or more of LOCAL[0-7].

In the end what matters most is what you want to do with the logs. Most of the time you are going to filter it and write it to some logfile (but you could also feed it to an index daemon or whatever...). So your final decision depends on what you want to achieve and how you are then able to filter relevant log entries.

If in doubt, I would recommend to use one of the LOCAL facilities to ease handling. But you probably still need to configure your receiving syslog server to handle the incoming messages.

share|improve this answer
So isn't LOCAL used for applications running in the same same machine as the syslog server, i.e. local applications?It can be used for remote applications as well?? – user65971 Feb 13 '11 at 17:57
Technically, they don't differ from the the other facilities. It's just a name in the end. I personally use the LOCAL facilities to distinguish different log categories from our loadbalancers. All these logs are send to a central syslog server. So yes, you can use it for whatever and wherever you want. – Holger Just Feb 13 '11 at 18:01
@user I believe LOCALx means locally defined, or defined by the local organization to mean whatever they want it to mean. – Keith Feb 13 '11 at 18:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .