rsyslog facilities


I am using Cumulus 2.5.7, rsyslog 5.8.11

I am hoping to use the LOG_LOCAL# facilities for example:

syslog(LOG_MAKEPRI(LOG_LOCAL0, LOG_NOTICE), "EXAMPLE 0"); 
syslog(LOG_MAKEPRI(LOG_LOCAL1, LOG_NOTICE), "EXAMPLE 1");


But upon making these syslog calls I see the following in /var/log/syslog:

2017-08-09T02:37:34.869527+00:00 hostname exampleTest[12554]: syslog: unknown facility/priority: 405
2017-08-09T02:37:34.869694+00:00 hostname exampleTest[12554]: EXAMPLE 0
2017-08-09T02:37:34.869781+00:00 hostname exampleTest[12554]: syslog: unknown facility/priority: 445
2017-08-09T02:37:34.869866+00:00 hostname exampleTest[12554]: EXAMPLE 1

On a Ubuntu workstation running rsyslog, I do not see these unknown facility/priority messages.

Is there support for LOG_LOCAL#?

1 reply

Userlevel 3
If you search for LOG_MAKEPRI, you'll see that it was defined different on different OS'es, and some versions shift the facility argument left by 3, while the definitions already include the shift. Debian patched that in wheezy rsyslogd, but the system header file still has the shift.

So you'll have to doublecheck your compilation environment, but from the values being printed, it's clear that the facility is being << 3 twice (<< 6).

In general, LOG_MAKEPRI is deprecated, and the facility is supposed to be set by calling openlog(), and then only pass the priority with syslog. That does prevent you from having different facilities on different syslog calls.

Anyway, if you want to use different facilities ala LOG_MAKEPRI, you'll have to define your own macro, after detecting that you have mismatched macro LOG_MAKEPRI and LOG_LOCAL0 (etc) values), where you just OR the priority and the facility, for that environment.

Reply