What does the syslog selector format mean and what values can I set in MetaDefender Optical Diode?

Overview

This knowledge base article explains the syslog selector format, including facilities and severity levels, and how they apply when configuring syslog forwarding for OPSWAT MetaDefender Diode deployments. Proper configuration ensures that relevant security and operational events are captured, filtered, and forwarded to external systems such as SIEM platforms.

What is a Syslog Selector?

A syslog selector defines which log messages should be captured and processed based on two attributes:

<facility>.<severity>

• Facility → Identifies the source or category of the log message
• Severity → Indicates the importance or urgency of the message

Relevance to MetaDefender Diode

• OPSWAT MetaDefender Diode typically uses local facilities (e.g., local6)
• This allows separation of OPSWAT logs from OS/system logs
• Recommended best practice is to dedicate a single local facility (e.g., local6) exclusively for MetaDefender Optical Diode logs.

Syslog Facility Values

Facilities categorize where logs originate. Syslog defines standard facilities as well as custom ones.

Common Standard Facilities

Custom (Local) Facilities

Syslog Severity Levels

Severity defines how critical a message is. Lower numbers indicate higher urgency.

If you have any questions on how this setup works and/or are having issue getting replication to work successfully, please reach out to our OPSWAT Support Team.