10/11/2018 7:56 PM

6/9/2023 9:19 AM

This article lists the severity levels for Syslog messages.

 

Security Event Manager

The meaning of syslog severity levels other than emergency and debugging are relative to the application.

For example, if the purpose of the system is to process transactions to update customer account balance information, an error in the final step should be assigned the alert level. However, an error occurring in an attempt to display the zip code of the customer may be assigned an error or even a warning level.

The server process which handles the message (syslogd) usually includes all lower levels. That is, if messages are separated by individual severity, a warning entry will be included in notice, info and debug processing.

Severity levels

VALUE	SEVERITY	KEYWORD	DESCRIPTION	EXAMPLES
0	Emergency	emerg	System is unusable	This level should not be used by applications.
1	Alert	alert	Should be corrected immediately	Loss of the primary ISP connection.
2	Critical	crit	Critical conditions	A failure in the system's primary application.
3	Error	err	Error conditions	An application has exceeded its file storage limit and attempts to write are failing.
4	Warning	warning	May indicate that an error will occur if action is not taken.	A non-root file system has only 2GB remaining.
5	Notice	notice	Events that are unusual, but not error conditions.
6	Informational	info	Normal operational messages that require no action.	An application has started, paused or ended successfully.
7	Debug	debug	Information useful to developers for debugging the application.

Note: Unless compliance demands it, levels 5, 6 and 7 are not required and will consume unnecessary resources.