syslog facilities

Question

I have an application (in java) running in a Windows PC and I want to send logging messages to a syslog server running in a Linux box somewhere in the network.
The problem I have is, that it is not clear to me what should I use as facility in this case.
I.e. can I (/should I) send the logging info as one of LOCAL0-LOCAL7?
Or are they not supposed to be used by remote applications? It is not clear to me if they are usable or not.
Should I use USER instead?

Could anyone help me on this please?

Answer 1

When your application matches one of the predefined facilities well, you should use it (e.g. when you have a mailserver, use mail). For most custom apps however it makes more sense to use one (or more of LOCAL[0-7].

In the end what matters most is what you want to do with the logs. Most of the time you are going to filter it and write it to some logfile (but you could also feed it to an index daemon or whatever...). So your final decision depends on what you want to achieve and how you are then able to filter relevant log entries.

If in doubt, I would recommend to use one of the LOCAL facilities to ease handling. But you probably still need to configure your receiving syslog server to handle the incoming messages.