pri calculator
Syslog PRI, facility & severity calculator
Compose a priority value from a facility and severity, or paste a PRI to decode it back — both directions, instantly. The full facility and severity reference tables are below.
24 facilities (0–23) tag where a message came from.
decodes to facility 4 (auth) · severity 2 (crit)
Guide
How the priority value works
The number in angle brackets at the start of a syslog message is the priority, or PRI. It is not a single rank — it packs two separate values into one byte using simple arithmetic:
PRI = facility × 8 + severity
Because severity occupies the lowest three bits (values 0–7) and facility occupies the rest, you can recover both with a division and a remainder: facility = PRI ÷ 8 and severity = PRI mod 8. The PRI therefore ranges from 0 (facility 0, severity 0) to 191 (facility 23, severity 7). The calculator above does the encode and the decode so you never have to do the modular arithmetic by hand. When you are reading a whole message rather than a bare number, the syslog parser shows the decoded facility and severity alongside the other fields.
Severity levels (0–7)
Severity says how urgent a message is. The counter-intuitive part is that lower is more severe: 0 means the system is unusable, while 7 is debug noise. The colours below are the severity scale used throughout this site.
| Code | Keyword | Label | Meaning |
|---|---|---|---|
| 0 | emerg | Emergency | System is unusable |
| 1 | alert | Alert | Action must be taken immediately |
| 2 | crit | Critical | Critical conditions |
| 3 | err | Error | Error conditions |
| 4 | warning | Warning | Warning conditions |
| 5 | notice | Notice | Normal but significant condition |
| 6 | info | Informational | Informational messages |
| 7 | debug | Debug | Debug-level messages |
A useful rule of thumb when filtering: “this severity and everything more severe” means “this number and lower.” Setting a collector to warning therefore captures warning, error, critical, alert, and emergency, but drops notice, info, and debug.
Facilities (0–23)
Facility says which part of the system produced the message. Codes 0–15 have fixed historical meanings; codes 16–23 are the local0–local7 slots you can repurpose for your own categories.
| Code | Keyword | Description |
|---|---|---|
| 0 | kern | Kernel messages |
| 1 | user | User-level messages |
| 2 | Mail system | |
| 3 | daemon | System daemons |
| 4 | auth | Security / authorization messages |
| 5 | syslog | Messages generated internally by syslogd |
| 6 | lpr | Line printer subsystem |
| 7 | news | Network news subsystem |
| 8 | uucp | UUCP subsystem |
| 9 | cron | Clock daemon |
| 10 | authpriv | Security / authorization messages (private) |
| 11 | ftp | FTP daemon |
| 12 | ntp | NTP subsystem |
| 13 | security | Log audit |
| 14 | console | Log alert |
| 15 | solaris-cron | Clock daemon (note 2) |
| 16 | local0 | Local use 0 |
| 17 | local1 | Local use 1 |
| 18 | local2 | Local use 2 |
| 19 | local3 | Local use 3 |
| 20 | local4 | Local use 4 |
| 21 | local5 | Local use 5 |
| 22 | local6 | Local use 6 |
| 23 | local7 | Local use 7 |
Worked examples
- Authentication failure: facility 4 (auth) + severity 2 (critical) =
<34>. - Routine application info: facility 1 (user) + severity 6 (info) =
<14>. This is the most common default a library will send. - Kernel emergency: facility 0 (kern) + severity 0 (emerg) =
<0>— the lowest possible value. - Local debug: facility 23 (local7) + severity 7 (debug) =
<191>— the highest possible value.
Once you have the facility and severity you want, the RFC 5424 builder drops them straight into a complete message, and the config generator turns a facility and a minimum severity into a forwarding rule.
Frequently asked questions
- How is the syslog PRI calculated?
- PRI = facility × 8 + severity. The facility is a number from 0 to 23 and the severity is 0 to 7, so the PRI ranges from 0 to 191. For example, facility 4 (auth) with severity 2 (critical) gives 4 × 8 + 2 = 34, written <34> at the start of the message.
- How do I get facility and severity back from a PRI value?
- Divide and take the remainder. Facility = floor(PRI ÷ 8) and severity = PRI mod 8. For <34>: 34 ÷ 8 = 4 (auth) and 34 mod 8 = 2 (critical). Paste a PRI into the decode box above and it shows both instantly.
- What are the syslog severity levels?
- There are eight, from most to least urgent: 0 Emergency, 1 Alert, 2 Critical, 3 Error, 4 Warning, 5 Notice, 6 Informational, 7 Debug. Lower numbers are more severe, which is the opposite of what people often expect.
- What are local0 through local7 used for?
- Facilities 16–23 (local0–local7) are reserved for local use. They have no predefined meaning, so administrators and applications use them for their own categories — for example sending a firewall's logs to local4 so they can be filtered out from the rest.
- What is the highest possible PRI value?
- 191. That is facility 23 (local7) with severity 7 (debug): 23 × 8 + 7 = 191. The lowest is 0, which is facility 0 (kern) with severity 0 (emergency).