Are used to categorize log messages. Each message is labelled with the facility code and severity level.
Facilities are used to indicate what type of program or from what part of the system message originated from. For example:
0 kern Kernel process messages
1 user Regular user process messages
2 mail Mail system process messages
3 daemon Other system daemons process messages
4 auth Authorization system or programs that ask for user names and passwords ( login, su, getty, ftpd) process messages
5 syslog System log process messages
6 lpr Line printer system process messages
7 news News subsystem process messages
8 uucp UUCP subsystem process messages
9 clock clock/timing subsystem process messages
10 authpriv A separate flag for routing authorization messages to a log file that has more restricted permissions than those of auth.
11 ftp File Transfer Protocol system process messages
12 ntp Network Time Protocol system process messages
13 log Audit alternate ID for authorization process messages
14 log Alert alternate ID for authorization process messages
15 clock Daemon alternate ID for cron (clock/timing) subsystem process messages
16–22 local use 0 through 7 Reserved for site-specific messages0 Emergency System is unusable. A "panic" condition, such as an imminent system crash, usually broadcast to all users.
1 Alert Action must be taken immediately. Notify staff who can fix the problem - example is a corrupted system database.
2 Critical Critical conditions, usually hardware errors. Indicates a failure in a primary system that should be corrected immediately. CRITICAL problems should be fixed before ALERT issues.
3 Error Error conditions. Non-urgent failures — these should be relayed to developers or administrators; each item must be resolved within a given time.
4 Warning Warning conditions. Warning messages are not errors but indications that an error will occur if action is not taken, e.g. file system 85% full. Each item must be resolved within a given time.
5 Notice Normal but significant condition. Events that are unusual but not error conditions — might be summarized in an email to developers or admins to spot potential problems. No immediate action required.
6 Informational Informational messages. Normal operational messages — may be harvested for reporting, measuring throughput, etc. No action required.
7 Debug Debug-level messages. Info useful to developers for debugging the application; not useful during operations.
8 None Do not send messages from the indicated facility to the selected file. For example, specifying *.debug;mail.none sends all messages except mail messages to the selected file.