Oh, that was a long debate... I intended to permit 2^32-1 facilities, but many others insisted on backward compatibility. If you search the ietf syslog-sec mailing list archive, you'll find a heated debate ;) So I really don't like to argue about that again. But the fact is that it doesn't help if everyone ignores the standard. There are ample ways of filtering different messages, especially if using RFC5424 format...
Rainer > -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of Sayan Chowdhury > Sent: Monday, November 30, 2009 5:59 PM > To: rsyslog-users > Subject: Re: [rsyslog] using arbitrary facility id > > BTW, just out of interest, why is this number restricted to 23 in the > rfc? > also each facility other than local0-7 seems to be rigidly defined. > Just > wanted to know why is it so ..shouldn't they have left scope for > extension > on this? > > > On Mon, Nov 30, 2009 at 11:51 AM, Sayan Chowdhury > <[email protected]>wrote: > > > Hello Rainer, > > Thanks... Yes I agree what I am doing is invalid. > > I was just trying it out, my idea was if I can use numbers greater > than > > 23, then I can maybe use it as my own customized logging system, and > I would > > use numbers greater than 23 for my application and use different ids > (>23) > > for different kind of application level log messages. I would try to > look > > into the code as well, is this something you thing may be useful in > general? > > Regards, > > Sayan > > > > > > > > On Mon, Nov 30, 2009 at 11:40 AM, Rainer Gerhards < > > [email protected]> wrote: > > > >> You can use facilities other than local0..local7, but you cannot use > a > >> facility with a numerical value greater than 23, because the > relevant > >> standards do not permit this (see RFC5424, Table 1). > >> > >> It may be that rsyslog does not properly prevent this, maybe it uses > >> modulo > >> 24 in this case. Will check that. But it is invalid in any case (not > only > >> with rsyslog but with any syslogd). > >> > >> Rainer > >> > >> > -----Original Message----- > >> > From: [email protected] [mailto:rsyslog- > >> > [email protected]] On Behalf Of Sayan Chowdhury > >> > Sent: Monday, November 30, 2009 5:20 PM > >> > To: rsyslog-users > >> > Subject: [rsyslog] using arbitrary facility id > >> > > >> > Hello All, > >> > Is it possible to use a facility id other than local0-local7? > >> > I was using a facility id of 50 in some of the messages , and I > had > >> > written > >> > a selector line in my rsyslog file as well to log messages with > >> > facility id > >> > of 50 into a seperate file. > >> > However, I see that sometimes the messages are being written into > all > >> > the > >> > files(/var/log/messages, boot.log,/var/log/secure etc) instead of > the > >> > one I > >> > specified in the rsyslog.conf. If I restart rsyslog the problem > goes > >> > away. > >> > I am using rsyslog version 4.2.0. > >> > > >> > Here is the selector line in my config > >> > > >> > > >> > if $fromhost-ip == '127.0.0.1' and $syslogfacility == '50' and > >> > $syslogseverity <= '6' then $log_rotation_50 > >> > > >> > where $log_rotation_50 is an outchannel which is configured to > rotate > >> > the > >> > file when it reaches the size of 2MB. > >> > Regards, > >> > Sayan > >> > _______________________________________________ > >> > rsyslog mailing list > >> > http://lists.adiscon.net/mailman/listinfo/rsyslog > >> > http://www.rsyslog.com > >> _______________________________________________ > >> rsyslog mailing list > >> http://lists.adiscon.net/mailman/listinfo/rsyslog > >> http://www.rsyslog.com > >> > > > > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
