Facilities¶
While the full list of facilities is reproduced here for completeness, using anything but LOG_AUTH, LOG_AUTHPRIV, and/or LOG_LOCAL0..7 is unlikely to have the desired results. LOG_USER can be used for Notices, but Info messages are generally not saved.
Facility | Description |
---|---|
LOG_AUTH |
security/authorization messages (use LOG_AUTHPRIV instead in systems where that constant is defined) |
LOG_AUTHPRIV |
security/authorization messages (private) |
LOG_CRON |
clock daemon (cron and at) |
LOG_DAEMON |
other system daemons |
LOG_KERN |
kernel messages |
LOG_LOCAL0…7 |
reserved for local use, these are not available in Windows |
LOG_LPR |
line printer subsystem |
LOG_MAIL |
mail subsystem |
LOG_NEWS |
USENET news subsystem |
LOG_SYSLOG |
messages generated internally by syslogd |
LOG_USER |
generic user-level messages |
LOG_UUCP |
UUCP subsystem |
Logfiles¶
OS | Level | LOG_AUTH | LOG_AUTHPRIV | LOG_USER |
---|---|---|---|---|
CentOS 7 | (not used) | /var/log/secure |
||
FeeBSD | INFO | /var/log/auth/log |
/var/log/auth/log |
|
NOTICE | /var/log/auth/log |
/var/log/auth/log |
/var/log/messages |
|
Ubuntu 18 | (all) | /var/log/auth.log |
/var/log/auth.log |
/var/log/syslog |