Does the PRI formula seem nonsensical to anyone? Facility number * 8 + severity level = PRI. At first looking at the example, I was thinking it would be an easy way to look at the last digit to determine severity (0-7), but since the result of facility number * 8 could contain any final digit, so that's a no go. Since severity is 0-7, and one multiplies facility by 8, no numbers would overlap, so one could eventually get used to the ranges and understand that, for example, PRIs 32-39 have something to do with auth (auth is facility 4, times 8 = 32, + 0 for emergency, up to +7 for debug), with 32 being an emergency and 39 being debug, but it seems unintuitive unless you're a sysadmin that sees these frequently.

It seems like simply concating the facility and severity level would give a much more intuitive at a glance understanding of what's going on, and make it easier to awk all, say, emergency severity levels since they'd all end in 0, or awk for all cron facilities, as they would start with 09, or all FTP errors (FTP facility 11 + error 3, 113). Range would be 000 (for kernel, emergency) to 237 (for local 23, debug). Of course, I don't know anything about syslogs except what I learned in this article, so maybe this is totally off base.