On Fri, 22 Oct 1999, Chris Calabrese wrote: > > Actually, I'm not sure that the facility is relevent. If you think > > about it, it's really just an arbitrary tag attached to each message > > in the current syslog scheme, and the categories are laid out in a > > completely useless manner. Facility isn't relevant? In what respect? If you mean as a tag in the log file I'd agree. As a field in the protocol, however, it's critical. I would never be able to manage the volume of log data our sites generate without a separate file for each facility: syslog,auth,local2,local3,local5,local6,local7.info;daemon.notice;user.none /dev/console kern.debug /var/log/kern.messages daemon.debug /var/log/daemon.messages user.debug /var/log/user.messages cron.err /var/log/cron.messages auth.debug /var/log/auth.messages news.debug /var/log/news.messages mail.info /var/log/mail.messages uucp.debug /var/log/uucp.messages lpr.err /var/log/lpr.messages local0.debug /var/log/local0.messages local1.debug /var/log/local1.messages local2.debug /var/log/local2.messages local3.debug /var/log/local3.messages local4.debug /var/log/local4.messages local5.debug /var/log/local5.messages local6.debug /var/log/local6.messages local7.debug /var/log/local7.messages *.debug @loghost > If we're going to give up the current syslog priorities, I'd go with the > 0..256, but with documented/standard mappings between this and the > existing syslog (debug,info,notice,warning,err,crit,alert,emerg) and SNMP > (normal,warning,minor,major,critical) priorities. Why would you need 256 priorities when almost no applications use more than 2 or 3 of the existing 8? -- Roger Marquis Roble Systems Consulting http://www.roble.com/
