# syslogfacility

Contains the numeric syslog facility extracted from the message.

This property belongs to the Message Properties group.

Name:

  syslogfacility

Category:

  Message Properties

Type:

  integer

## Description

Reports the numeric syslog facility defined in RFC 3164 and RFC 5424 (Table 1 of RFC 5424). The field is a 5-bit code describing the general origin of the message (for example 3 for `daemon` or 20 for `local4`). Facility values combine with severity to form the PRI value (`PRI = facility * 8 + severity`), but otherwise remain independent. For inputs received without a syslog header, rsyslog supplies this value from configuration or other metadata.

## Usage

    template(name="example" type="list") {
        property(name="syslogfacility")
    }

### Notes

- Common facility codes:

  - 0 `kern`

  - 1 `user`

  - 2 `mail`

  - 3 `daemon`

  - 4 `auth`

  - 5 `syslog`

  - 6 `lpr`

  - 7 `news`

  - 8 `uucp`

  - 9 `cron`

  - 10 `authpriv`

  - 11 `ftp`

  - 12-15 reserved/OS-specific

  - 16-23 `local0`..``local7``

- Applications assign facilities themselves, so naming can diverge by platform. The `local0`..``local7`` range is intentionally left for site-defined uses.

- Filter or route by facility, for example `if $syslogfacility == 3` or with legacy selectors such as `mail.*`.

## See also

See rsyslog Properties for the category overview.

Support: rsyslog Assistant | GitHub Discussions | GitHub Issues: rsyslog source project

Contributing: Source & docs: rsyslog source project

© 2008–2025 Rainer Gerhards and others. Licensed under the Apache License 2.0.