SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/secplus-syslog-emergency-zero

In syslog (RFC 5424), which severity code is the most severe?

0, Emergency: system is unusable. Debug (7) is the least severe.

Start playing free

  1. 4 (Warning)
  2. 7 (Debug)
  3. 0 (Emergency) ✔

Why: Syslog severity runs from 0 to 7, and lower numbers are worse. Emergency means the system is unusable. Alert (1) means act immediately, and Debug (7) is only for troubleshooting detail.

Huh, didn't know that: RFC 5424, published in 2009, replaced the older informational syslog document RFC 3164.

The dad joke
Syslog level zero is Emergency. My inbox on Monday morning is level zero too.
Like this card?
Play the game

References

Answer: 0 (Emergency). Syslog severity runs from 0 to 7, and lower numbers are worse. Emergency means the system is unusable. Alert (1) means act immediately, and Debug (7) is only for troubleshooting detail.

  1. IETF RFC 5424, The Syslog Protocol www.rfc-editor.org/rfc/rfc5424
    0 Emergency: system is unusable
    Checked 2026-10-10.
  2. IETF RFC 5424, The Syslog Protocol www.rfc-editor.org/rfc/rfc5424
    1 Alert: action must be taken immediately
    Checked 2026-10-10.
  3. IETF RFC 5424, The Syslog Protocol www.rfc-editor.org/rfc/rfc5424
    This document obsoletes RFC 3164, which is an Informational document
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Security & PrivacyWhat does a SIEM mainly do with the log data it collects?Security & PrivacyA user signs in from Nashville and, ten minutes later, from Tokyo. Which indicator of compromise is this?Security & PrivacyWhy does NIST advise using NTP to keep log sources' clocks consistent?

That's stuff everyone should know.