facility
Specifies the subsystem that produced the message. The valid keywords for facility are auth, authpriv, cron, daemon, kern, lpr, mail, news, syslog, user, uucp, and local0 through local7.

priority
Specifies the minimum severity of the message, meaning that messages of this priority and higher will be matched by this rule. The valid keywords for priority are debug, info, notice, warning, err, crit, alert, and emerg.

action
The action field should be either a filename, tty (such as /dev/console), remote machine prefixed by @ , comma-separated list of users, or * to send the message to everybody logged on. The most common action is a simple filename.