It is possible to set the facility field with the set-facility() rewrite function. The set-facility() rewrite function rewrites only the facility part of the PRIORITY value in the message, while preserving the severity part.

If the specified parameter value is not a valid value, the function ignores it and sends a debug message. However, the (syslog-ng OSE application will still send the message.

Declaration

log {
  source { system(); };
    if (program("postfix")) {
      rewrite { set-facility("mail"); };
    };
    destination { file("/var/log/mail.log"); };
    flags(flow-control);
};

Parameters

The set-facility() rewrite function has a single, mandatory parameter that can be defined as follows:

set-facility( "parameter1" );

Accepted values

The set-facility() rewrite function accepts the following values:

  • numeric strings: [0-127]

  • named values: kern, user, mail, daemon, auth, syslog, lpr, news, uucp, cron, authpriv, megasafe, ftp, ntp, security, console, solaris-cron, local0, local1, local2, local3, local4, local5, local6, local7

Example usage for the set-facility() rewrite function

The following example can be used in production for the set-facility() rewrite function.

rewrite {
set-facility("mail");
set-facility("6");
set-facility("${.json.facility}");
};

Updated: