# syslogseverity

Provides the numeric syslog severity extracted from the message.

This property belongs to the Message Properties group.

Name:

  syslogseverity

Category:

  Message Properties

Type:

  integer

Aliases:

  syslogpriority

## Description

Reports the numeric syslog severity defined in RFC 3164 and RFC 5424 (Table 2 of RFC 5424). The field is a 3-bit integer from 0 (`emerg`) to 7 (`debug`); smaller numbers indicate higher urgency. The sending application chooses this value, so real-world usage can vary and mappings are sometimes fuzzy. Severity combines with the facility code to form the PRI value (`PRI = facility * 8 + severity`). When rsyslog accepts messages without a syslog header, the severity comes from configured defaults or input metadata rather than a value that was transmitted on the wire.

## Usage

    template(name="example" type="list") {
        property(name="syslogseverity")
    }

### Notes

- Canonical severities:

  - 0 `emerg`

  - 1 `alert`

  - 2 `crit`

  - 3 `err`

  - 4 `warning`

  - 5 `notice`

  - 6 `info`

  - 7 `debug`

- Filter by number or name; for example `if $syslogseverity <= 3 then ...` routes urgent messages (`emerg` through `err`).

- The textual property syslogseverity-text exposes the same information as words. Legacy selector syntax such as `*.err` works as well.

### Aliases

- syslogpriority — alias for syslogseverity

## See also

See rsyslog Properties for the category overview.

Support: rsyslog Assistant | GitHub Discussions | GitHub Issues: rsyslog source project

Contributing: Source & docs: rsyslog source project

© 2008–2025 Rainer Gerhards and others. Licensed under the Apache License 2.0.