1 .\" Copyright (c) 1990, 1991, 1993
2 .\" The Regents of the University of California. All rights reserved.
4 .\" Redistribution and use in source and binary forms, with or without
5 .\" modification, are permitted provided that the following conditions
7 .\" 1. Redistributions of source code must retain the above copyright
8 .\" notice, this list of conditions and the following disclaimer.
9 .\" 2. Redistributions in binary form must reproduce the above copyright
10 .\" notice, this list of conditions and the following disclaimer in the
11 .\" documentation and/or other materials provided with the distribution.
12 .\" 3. All advertising materials mentioning features or use of this software
13 .\" must display the following acknowledgement:
14 .\" This product includes software developed by the University of
15 .\" California, Berkeley and its contributors.
16 .\" 4. Neither the name of the University nor the names of its contributors
17 .\" may be used to endorse or promote products derived from this software
18 .\" without specific prior written permission.
20 .\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
21 .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23 .\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
24 .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25 .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26 .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27 .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28 .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32 .\" @(#)syslog.conf.5 8.1 (Berkeley) 6/9/93
33 .\" $FreeBSD: src/usr.sbin/syslogd/syslog.conf.5,v 1.35 2004/07/03 18:35:53 ru Exp $
34 .\" $DragonFly: src/usr.sbin/syslogd/syslog.conf.5,v 1.3 2004/08/09 20:11:19 dillon Exp $
47 file is the configuration file for the
51 blocks of lines separated by
55 specifications (separations appear along on the line),
56 with each line containing two fields: the
58 field which specifies the types of messages and priorities to which the
61 field which specifies the action to be taken if a message
63 receives matches the selection criteria.
66 field is separated from the
68 field by one or more tab characters or spaces.
70 Note that if you use spaces as separators, your
72 might be incompatible with other Unices or Unix-like systems.
73 This functionality was added for ease of configuration
74 (e.g.\& it is possible to cut-and-paste into
76 and to avoid possible mistakes.
77 This change however preserves
78 backwards compatibility with the old style of
80 (i.e., tab characters only).
88 an optional set of comparison flags
89 .Pq Oo \&! Oc Op <=> ,
92 with no intervening white-space.
101 describes the part of the system generating the message, and is one of
102 the following keywords: auth, authpriv, console, cron, daemon, ftp, kern,
103 lpr, mail, mark, news, ntp, security, syslog, user, uucp and local0 through
105 These keywords (with the exception of mark) correspond to
108 values specified to the
116 may be used to specify exactly what is logged.
117 The default comparison is
121 which means that messages from the specified
123 list, and of a priority
124 level equal to or greater than
127 Comparison flags beginning with
129 will have their logical sense inverted.
132 means all levels except info and
134 has the same meaning as
139 describes the severity of the message, and is a keyword from the
140 following ordered list (higher to lower): emerg, alert, crit, err,
141 warning, notice, info and debug.
142 These keywords correspond to
145 values specified to the
149 Each block of lines is separated from the previous block by a
154 A block will only log messages corresponding to the most recent
158 specifications given.
159 Thus, with a block which selects
163 directly followed by a block that selects messages from the
166 the second block will only log messages
173 specification is a line beginning with
177 (the former is for compatibility with the previous syslogd, if one is sharing
180 and the following blocks will be associated with calls to
182 from that specific program.
187 will also match any message logged by the kernel with the prefix
193 specification works just like the previous one,
198 specification will match any message but the ones from that
200 Multiple programs may be listed, separated by commas:
202 matches messages from either program, while
204 matches all messages but those from
211 specification of the form
215 means the following blocks will be applied to messages
216 received from the specified hostname.
223 causes the following blocks to be applied to messages
224 from any host but the one specified.
225 If the hostname is given as
227 the local hostname will be used.
228 As for program specifications, multiple comma-seprarated
229 values may be specified for hostname specifications.
235 specification may be reset by giving the program or hostname as
240 for further descriptions of both the
244 keywords and their significance.
245 It's preferred that selections be made on
249 since the latter can easily vary in a networked environment.
251 though, an appropriate
253 simply doesn't exist.
255 If a received message matches the specified
257 and is of the specified
259 .Em (or a higher level) ,
260 and the first word in the message after the date matches the
262 the action specified in the
268 may be specified for a single
270 by separating them with semicolon
273 It is important to note, however, that each
275 can modify the ones preceding it.
279 may be specified for a single
281 by separating them with comma
287 can be used to specify all
297 receives a message at priority
302 This is not enabled by a
304 field containing an asterisk.
309 disables a particular
314 field of each line specifies the action to be taken when the
316 field selects a message.
317 There are five forms:
320 A pathname (beginning with a leading slash).
321 Selected messages are appended to the file.
323 To ensure that kernel messages are written to disk promptly,
327 after writing messages from the kernel.
328 Other messages are not synced explicitly.
329 You may prefix a pathname with the minus sign,
331 to forego syncing the specified file after every kernel message.
332 Note that you might lose information if the system crashes
333 immediately following a write attempt.
334 Nevertheless, using the
336 option may improve performance,
337 especially if the kernel is logging many messages.
339 A hostname (preceded by an at
342 Selected messages are forwarded to the
344 program on the named host.
346 A comma separated list of users.
347 Selected messages are written to those users
348 if they are logged in.
351 Selected messages are written to all logged-in users.
355 followed by a command to pipe the selected
357 The command is passed to
359 for evaluation, so usual shell metacharacters or input/output
360 redirection can occur.
361 (Note however that redirecting
363 buffered output from the invoked command can cause additional delays,
364 or even lost output data in case a logging subprocess exited with a
366 The command itself runs with
375 will close the pipe to the process.
376 If the process didn't exit
377 voluntarily, it will be sent a
379 signal after a grace period of up to 60 seconds.
381 The command will only be started once data arrives that should be piped
383 If it exited later, it will be restarted as necessary.
385 is desired that the subprocess should get exactly one line of input only
386 (which can be very resource-consuming if there are a lot of messages
387 flowing quickly), this can be achieved by exiting after just one line of
389 If necessary, a script wrapper can be written to this effect.
391 Unless the command is a full pipeline, it's probably useful to
392 start the command with
394 so that the invoking shell process does not wait for the command to
396 Warning: the process is started under the UID invoking
398 normally the superuser.
401 Blank lines and lines whose first non-blank character is a hash
403 character are ignored.
405 A configuration file might appear as follows:
407 # Log all kernel messages, authentication messages of
408 # level notice or higher, and anything of level err or
409 # higher to the console.
410 # Don't log private authentication messages!
411 *.err;kern.*;auth.notice;authpriv.none /dev/console
413 # Log anything (except mail) of level info or higher.
414 # Don't log private authentication messages!
415 *.info;mail.none;authpriv.none /var/log/messages
417 # Log daemon messages at debug level only
418 daemon.=debug /var/log/daemon.debug
420 # The authpriv file has restricted access.
421 authpriv.* /var/log/secure
423 # Log all the mail messages in one place.
424 mail.* /var/log/maillog
426 # Everybody gets emergency messages, plus log them on another
429 *.emerg @arpa.berkeley.edu
431 # Root and Eric get alert and higher messages.
434 # Save mail and news errors of level err and higher in a
436 uucp,news.crit /var/log/spoolerr
438 # Pipe all authentication messages to a filter.
439 auth.* |exec /usr/local/sbin/authfilter
441 # Save ftpd transactions along with mail and news
443 *.* /var/log/spoolerr
445 # Log all security messages to a separate file.
446 security.* /var/log/security
448 # Log all writes to /dev/console to a separate file.
449 console.* /var/log/console.log
451 # Log ipfw messages without syncing after every message.
455 .Sh IMPLEMENTATION NOTES
458 facility is usually reserved for messages
459 generated by the local kernel.
460 Other messages logged with facility
462 are usually translated to facility
464 This translation can be disabled;
469 .Bl -tag -width /etc/syslog.conf -compact
470 .It Pa /etc/syslog.conf
475 The effects of multiple
477 are sometimes not intuitive.
482 facility messages at the level of
484 or higher, not at the level of
488 In networked environments, note that not all operating systems
489 implement the same set of facilities.
491 authpriv, cron, ftp, and ntp that are known to this implementation
492 might be absent on the target system.
493 Even worse, DEC UNIX uses
494 facility number 10 (which is authpriv in this implementation) to
495 log events for their AdvFS file system.