Allied Telesis AT-S63 - Manual (Page 240)

Chapter 15: Event Log and Syslog Client Commands
240 Section II: Advanced Operations
The FACILITY parameter adds a numerical code to the entries as they are
sent to the syslog server so that the entries are grouped on the server
according to the source device. This is of particular value when a syslog
server is collecting events from several difference network devices. You
can specify only one facility level for a syslog server definition.
There are two approaches to using this parameter. The first is to use the
DEFAULT option. This setting determines the codes of the messages
based on the functional groupings in the RFC 3164 standard. For
example, encryption key events and port mirroring events would be
assigned codes 4 and 22, respectively. The codes that are applicable to
the AT-S63 Management Software and its modules are shown in Table 6.
Another approach is assign the same numerical code to all of the events
using the LOCAL1 to LOCAL7 options, each of which represents a
predefined RFC 3164 numerical code, as listed in Table 7. For example,
the facility level LOCAL2 assigns the numerical code 18 to all of the
events sent by the stack to the syslog server.
Table 6. Default Syslog Facilities
Facility
Number
Syslog Protocol
Definition
Mapped Event Log Modules and
Events
4 Security/
authorization
messages Security and authorization
messages from the following
modules: DOS, ENCO, PACCESS
(802.1x), PKI, PSEC (port security),
RADIUS, SSH, SSL, TACACS+,
and system events such as user
login and logout.
9 Clock daemon Time-based activities and events
from the following modules: TIME,
SNTP, and RTC.
16 Local use 0 All other modules and events.
22 Local use 6 Physical interface and data link
events from the following modules:
PCFG (port configuration), PMIRR
(port mirroring), PTRUNK (port
trunking), STP, and VLANs.
23 Local use 7 System events related to major
exceptions.