{"id":487,"date":"2013-02-03T17:53:00","date_gmt":"2013-02-03T17:53:00","guid":{"rendered":"http:\/\/www.balajibandi.com\/?p=487"},"modified":"2017-09-03T17:57:20","modified_gmt":"2017-09-03T16:57:20","slug":"how-to-determine-the-syslog-facility-using-tcpdump","status":"publish","type":"post","link":"https:\/\/www.balajibandi.com\/?p=487","title":{"rendered":"How to determine the Syslog Facility using tcpdump"},"content":{"rendered":"

How to determine the Syslog Facility using tcpdump<\/strong><\/span><\/h1>\n

Each Syslog message contains a priority value. The priority value is enclosed within the characters < >. The priority value can be between 0 and 191 and consists of a Facility value and a Level value. Facility being the type of message, such as a kernel or mail message. And level being a severity level of the message.<\/p>\n

To calculate the priority value the following formula is used :\u00a0Priority = Facility * 8 + Level<\/strong><\/p>\n

So to determine the facility value of a syslog message we divide the priority value by 8. The remainder is the level value.<\/p>\n

My Cisco Config :<\/p>\n

logging trap debugging
\nlogging source-interface Vlan100
\nlogging host 192.168.1.67 \u00a0 \u00a0– SYSLOG Server<\/p>\n

Below is an example of the tcpdump syntax :<\/p>\n

\"\"<\/p>\n

Using the above example this would give us a facility of 17 (local1) and a level of 5 (notice)<\/p>\n

\"\"<\/p>\n

Severity Levels<\/strong><\/p>\n

0 Emergency: system is unusable
\n1 Alert: action must be taken immediately
\n2 Critical: critical conditions
\n3 Error: error conditions
\n4 Warning: warning conditions
\n5 Notice: normal but significant condition
\n6 Informational: informational messages
\n7 Debug: debug-level messages<\/p>\n

Facilities available<\/strong><\/p>\n

0 kernel messages
\n1 user-level messages
\n2 mail system
\n3 system daemons
\n4 security\/authorization messages
\n5 messages generated internally by syslogd
\n6 line printer subsystem
\n7 network news subsystem
\n8 UUCP subsystem
\n9 clock daemon
\n10 security\/authorization messages
\n11 FTP daemon
\n12 NTP subsystem
\n13 log audit
\n14 log alert
\n15 clock daemon
\n16 local use 0 (local0)
\n17 local use 1 (local1)
\n18 local use 2 (local2)
\n19 local use 3 (local3)
\n20 local use 4 (local4)
\n21 local use 5 (local5)
\n22 local use 6 (local6)
\n23 local use 7 (local7)<\/p>\n","protected":false},"excerpt":{"rendered":"

How to determine the Syslog Facility using tcpdump Each Syslog message contains a priority value. The priority value is enclosed within the characters < >. The priority value can be between 0 and 191 and consists of a Facility value and a Level value. Facility being the type of message, such as a kernel or […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-487","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=\/wp\/v2\/posts\/487","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=487"}],"version-history":[{"count":1,"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=\/wp\/v2\/posts\/487\/revisions"}],"predecessor-version":[{"id":490,"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=\/wp\/v2\/posts\/487\/revisions\/490"}],"wp:attachment":[{"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=487"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=487"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=487"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}