Syslog LOCAL Facility Codes

Question

I have found examples online suggesting that a SyslogFacility can be set\get with a "local0" thru "local7" level.

ex... message.Facility = SyslogFacility.local0;

However, I am not able to set these values. Is there a way to use the "local" values?

Answer 1

Please note that facility values local0 thru local7 are not explicitly defined in Rebex Syslog API currently. However, you can specify any value between 0 and 255 for facility in the API like this:

var client = new SyslogClient();
client.Connect(...);
client.Send(message, SyslogSeverity.Notice, (SyslogFacility)20);

In RFC 5424 the values for local0 thru local7 are defined as follows:

16 - local use 0 (local0)
17 - local use 1 (local1)
18 - local use 2 (local2)
19 - local use 3 (local3)
20 - local use 4 (local4)
21 - local use 5 (local5)
22 - local use 6 (local6)
23 - local use 7 (local7)

So, in the example above, the (SyslogFacility)20 means local4.

Comments

Thanks for the info.  I am receiving messages from a Cisco switch and am having a difficult time getting the "localx" categories assignments.  I know they're configured on the switch because we are running a similar Syslog application in parallel and it sees this assignment.

Sample of my custom logger:

private async Task ProcessMessagesAsync(SyslogMessageReceivedEventArgs m)
{

    int FacilityCode = (int)m.Message.Facility;

    await Task.Run(() => Process_Logger.WriteProcLog(
                                    m.Message.Facility.ToString() + "|" +
                                    FacilityCode.ToString() + "." +
                                    m.Message.Severity.ToString() + "|" +
                                    m.Message.Text + "|" +
                                    m.RemoteEndPoint + "|" +
                                    m.RemoteEndPoint.Address));
                               
}

---

To handle facility at the server side, you can simply cast the `SyslogFacility` type to `int` and process the value as you like.

For example, if you would like to display custom string for facility codes, you can write simple "SyslogFacility -> string" conversion method like this:

    private static string ToLogString(SyslogFacility facility)
    {
        int value = (int)facility;
        if (value >= 16 && value <= 23)
            return "local" + (value - 16);
        else
            return facility.ToString();
    }

Then in your code, just use:

     ToLogString(m.Message.Facility) + "|" + ...

This will log:
- Kernel/User/Mail/System/... for well-known defined values
- local0/local1/local2/... for values in range 16-23
- a number for values in range 24-255

---

Awesome.  It worked great.  Thank you!