You can use facilities other than local0..local7, but you cannot use a facility with a numerical value greater than 23, because the relevant standards do not permit this (see RFC5424, Table 1).
It may be that rsyslog does not properly prevent this, maybe it uses modulo 24 in this case. Will check that. But it is invalid in any case (not only with rsyslog but with any syslogd). Rainer > -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of Sayan Chowdhury > Sent: Monday, November 30, 2009 5:20 PM > To: rsyslog-users > Subject: [rsyslog] using arbitrary facility id > > Hello All, > Is it possible to use a facility id other than local0-local7? > I was using a facility id of 50 in some of the messages , and I had > written > a selector line in my rsyslog file as well to log messages with > facility id > of 50 into a seperate file. > However, I see that sometimes the messages are being written into all > the > files(/var/log/messages, boot.log,/var/log/secure etc) instead of the > one I > specified in the rsyslog.conf. If I restart rsyslog the problem goes > away. > I am using rsyslog version 4.2.0. > > Here is the selector line in my config > > > if $fromhost-ip == '127.0.0.1' and $syslogfacility == '50' and > $syslogseverity <= '6' then $log_rotation_50 > > where $log_rotation_50 is an outchannel which is configured to rotate > the > file when it reaches the size of 2MB. > Regards, > Sayan > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
