A facility is the first mandatory field in a Syslog message. It identifies the service, application, or device component that generated the message. section 7.2
Reading a Syslog facility
In %LINK-3-UPDOWN, LINK is the facility. It identifies a link-related source, commonly an interface whose state changed. UPDOWN is the separate mnemonic, while the description supplies the affected interface and event. section 7.2
Identify the facility by separating it from neighboring Syslog fields:
- Use the format %facility-severity-mnemonic to locate the facility. section 7.3
- Do not confuse the facility with severity, which indicates urgency, or the mnemonic, which describes the triggering event. section 7.2
- Recognize the facility in Syslog messages rather than memorizing the available facility names for CCNA exam purposes. section 7.2
000065: Sep 19 01:01:01.133: %LINK-3-UPDOWN: Interface FastEthernet0/1, changed state to down
Use the complete message to locate LINK and distinguish it from the severity, mnemonic, and description. section 7.2
