Syslog PRI Calculator

Every syslog message sent over a network begins with a number in angle brackets, such as <34>. It looks arbitrary, but it packs two facts into one value: which part of the system the message came from, and how serious it is. The page converts in both directions and shows what the filter notation of rsyslog would look like.

The formula

The PRI value is the facility multiplied by 8 plus the severity. Facility numbers run from 0 to 23, severity numbers from 0 to 7. Because severity occupies the lowest three bits, you can decode by hand: divide by 8 and the quotient is the facility and the remainder the severity. The definitions come from RFC 5424, the current syslog protocol, and RFC 3164 before it. The highest valid value is 191.

Facilities and severities

The facilities are 0 kern, 1 user, 2 mail, 3 daemon, 4 auth, 5 syslog, 6 lpr, 7 news, 8 uucp, 9 cron, 10 authpriv, 11 ftp, 12 ntp, 13 audit, 14 alert, 15 clock, and 16 to 23 local0 to local7. The severities are 0 Emergency, 1 Alert, 2 Critical, 3 Error, 4 Warning, 5 Notice, 6 Informational and 7 Debug. Applications choose their own facility; the local0 to local7 range is free for any use, which is why network equipment is often configured to log to one of them and the collector sorts on it.

Using the page

Pick a direction. “Facility and severity → PRI” shows two lists with their descriptions and produces the value with the angle brackets. “PRI → facility and severity” accepts a number or the bracketed form such as <165>. Quick buttons load auth.crit and a decode of <165> and local0.info. The result shows the PRI field, the facility and severity with their descriptions, the selector as used in rsyslog or syslog.conf (for example auth.crit), an example message start in the RFC 5424 format and a table of PRI values for every severity of that facility.

A worked example

Take facility 4 (auth) and severity 2 (crit). The PRI is 4 × 8 + 2 = 34, written <34>; the selector is auth.crit, and the example message start is <34>1 2026-10-30T14:05:09Z host app - - - message. The facility’s table runs from <32> for Emergency to <39> for Debug. Going the other way, the example from RFC 5424, <165>, decodes as 165 ÷ 8 = 20 remainder 5: facility 20 (local4) and severity 5 (Notice).

Limits

The page converts numbers and shows examples; it does not parse a full log line or contact any server. Facility names are conventional: a device that logs with facility 16 is not necessarily doing anything related to its name, and filters in rsyslog and syslog-ng have their own syntax beyond the simple selector. Some systems also use a different severity name for the same number in their output. For the timestamps in those lines, the Timestamp Converter can help.

Related tools

• Timestamp Converter reads the time in syslog and log lines.
• Packet Header Decoder shows the UDP datagram that carries syslog.
• Port Number Lookup shows that syslog uses UDP port 514 by convention.
• Wireshark Filter Builder writes a filter to capture syslog traffic.