This article explains the meaning of the term "Facility" that appears in the Syslog Servers window under Log/Monitoring > Events > Settings, Log/Monitoring > User Access > Settings, and Log/Monitoring > Admin Access > Settings.
Problem or Goal
The Settings option is found under Log/Monitoring > Events, Log/Monitoring > User Access, and Log/Monitoring > Admin Access.
The Facility pull-down menu is found in the Syslog Servers window.
The Syslog Server receives log messages and acts on each message's type (or facility) and its priority (set on the Syslog Server).
A Facility Level is used to specify what type of program is logging the message.
Facility Levels allow the Syslog Server to handle messages according to the Priority Level set for each type of message. This allows for greater flexibility: Messages for one node or cluster can be handled differently by assigning them different Facility Levels.
auth -> authentication messages
cron - > messages from scheduler
daemon -> messages from resident daemons
kern -> kernel messages
lpr -> printer messages
user -> messages from user-initiated processes/apps
mail -> messages from mail service
local0-local7 -> user-defined (Define on the Junos Pulse Secure Access gateway to match the local[x] configured on the Syslog Server.)
syslog -> messages from the syslog process itself
0 - Emergency (emerg)
1 - Alerts (alert)
2 - Critical (crit)
3 - Errors (err)
4 - Warnings (warn)
5 - Notification (notice)
6 - Information (info)
7 - Debug (debug)
On the Pulse Connect Secure gateway, the Facility must be defined.
The Priority Level(s) should be decided on the Syslog Server.
The higher the priority, the more verbose the data included in the logs.