1.\" Copyright (c) 1990, 1991, 1993 2.\" The Regents of the University of California. All rights reserved. 3.\" 4.\" Redistribution and use in source and binary forms, with or without 5.\" modification, are permitted provided that the following conditions 6.\" are met: 7.\" 1. Redistributions of source code must retain the above copyright 8.\" notice, this list of conditions and the following disclaimer. 9.\" 2. Redistributions in binary form must reproduce the above copyright 10.\" notice, this list of conditions and the following disclaimer in the 11.\" documentation and/or other materials provided with the distribution. 12.\" 4. Neither the name of the University nor the names of its contributors 13.\" may be used to endorse or promote products derived from this software 14.\" without specific prior written permission. 15.\" 16.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 17.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 20.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 21.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 22.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 23.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 24.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 25.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26.\" SUCH DAMAGE. 27.\" 28.\" @(#)syslog.conf.5 8.1 (Berkeley) 6/9/93 29.\" $FreeBSD: src/usr.sbin/syslogd/syslog.conf.5,v 1.46 2008/12/23 17:39:24 trhodes Exp $ 30.\" $DragonFly: src/usr.sbin/syslogd/syslog.conf.5,v 1.10 2008/04/20 21:14:39 swildner Exp $ 31.\" 32.Dd December 23, 2008 33.Dt SYSLOG.CONF 5 34.Os 35.Sh NAME 36.Nm syslog.conf 37.Nd 38.Xr syslogd 8 39configuration file 40.Sh DESCRIPTION 41The 42.Nm 43file is the configuration file for the 44.Xr syslogd 8 45program. 46It consists of 47blocks of lines separated by 48.Em program 49and 50.Em hostname 51specifications (separations appear alone on their lines), 52with each line containing two fields: the 53.Em selector 54field which specifies the types of messages and priorities to which the 55line applies, and an 56.Em action 57field which specifies the action to be taken if a message 58.Xr syslogd 8 59receives matches the selection criteria. 60The 61.Em selector 62field is separated from the 63.Em action 64field by one or more tab characters or spaces. 65.Pp 66Note that if you use spaces as separators, your 67.Nm 68might be incompatible with other Unices or Unix-like systems. 69This functionality was added for ease of configuration 70(e.g.\& it is possible to cut-and-paste into 71.Nm ) , 72and to avoid possible mistakes. 73This change however preserves 74backwards compatibility with the old style of 75.Nm 76(i.e., tab characters only). 77.Pp 78The 79.Em selectors 80are encoded as a 81.Em facility , 82a period 83.Pq Dq \&. , 84an optional set of comparison flags 85.Pq Oo \&! Oc Op <=> , 86and a 87.Em level , 88with no intervening white-space. 89Both the 90.Em facility 91and the 92.Em level 93are case insensitive. 94.Pp 95The 96.Em facility 97describes the part of the system generating the message, and is one of 98the following keywords: 99.Cm auth , authpriv , console , cron , daemon , ftp , kern , lpr , 100.Cm mail , mark , news , ntp , security , syslog , user , uucp , 101and 102.Cm local0 103through 104.Cm local7 . 105These keywords (with the exception of mark) correspond to 106similar 107.Dq Dv LOG_ 108values specified to the 109.Xr openlog 3 110and 111.Xr syslog 3 112library routines. 113.Pp 114The 115.Em comparison flags 116may be used to specify exactly what is logged. 117The default comparison is 118.Dq => 119(or, if you prefer, 120.Dq >= ) , 121which means that messages from the specified 122.Em facility 123list, and of a priority 124level equal to or greater than 125.Em level 126will be logged. 127Comparison flags beginning with 128.Dq Li \&! 129will have their logical sense inverted. 130Thus 131.Dq !=info 132means all levels except info and 133.Dq !notice 134has the same meaning as 135.Dq <notice . 136.Pp 137The 138.Em level 139describes the severity of the message, and is a keyword from the 140following ordered list (higher to lower): 141.Cm emerg , crit , alert , err , warning , notice , info 142and 143.Cm debug . 144These keywords correspond to 145similar 146.Dq Dv LOG_ 147values specified to the 148.Xr syslog 3 149library routine. 150.Pp 151Each block of lines is separated from the previous block by a 152.Em program 153or 154.Em hostname 155specification. 156A block will only log messages corresponding to the most recent 157.Em program 158and 159.Em hostname 160specifications given. 161Thus, with a block which selects 162.Ql ppp 163as the 164.Em program , 165directly followed by a block that selects messages from the 166.Em hostname 167.Ql dialhost , 168the second block will only log messages 169from the 170.Xr ppp 8 171program on dialhost. 172.Pp 173A 174.Em program 175specification is a line beginning with 176.Ql #!prog 177or 178.Ql !prog 179(the former is for compatibility with the previous syslogd, if one is sharing 180.Nm 181files, for example) 182and the following blocks will be associated with calls to 183.Xr syslog 3 184from that specific program. 185A 186.Em program 187specification for 188.Ql foo 189will also match any message logged by the kernel with the prefix 190.Ql "foo: " . 191The 192.Ql #!+prog 193or 194.Ql !+prog 195specification works just like the previous one, 196and the 197.Ql #!-prog 198or 199.Ql !-prog 200specification will match any message but the ones from that 201program. 202Multiple programs may be listed, separated by commas: 203.Ql !prog1,prog2 204matches messages from either program, while 205.Ql !-prog1,prog2 206matches all messages but those from 207.Ql prog1 208or 209.Ql prog2 . 210.Pp 211A 212.Em hostname 213specification of the form 214.Ql #+hostname 215or 216.Ql +hostname 217means the following blocks will be applied to messages 218received from the specified hostname. 219Alternatively, the 220.Em hostname 221specification 222.Ql #-hostname 223or 224.Ql -hostname 225causes the following blocks to be applied to messages 226from any host but the one specified. 227If the hostname is given as 228.Ql @ , 229the local hostname will be used. 230As for program specifications, multiple comma-separated 231values may be specified for hostname specifications. 232.Pp 233A 234.Em program 235or 236.Em hostname 237specification may be reset by giving the program or hostname as 238.Ql * . 239.Pp 240See 241.Xr syslog 3 242for further descriptions of both the 243.Em facility 244and 245.Em level 246keywords and their significance. 247It is preferred that selections be made on 248.Em facility 249rather than 250.Em program , 251since the latter can easily vary in a networked environment. 252In some cases, 253though, an appropriate 254.Em facility 255simply does not exist. 256.Pp 257If a received message matches the specified 258.Em facility 259and is of the specified 260.Em level 261.Em (or a higher level) , 262and the first word in the message after the date matches the 263.Em program , 264the action specified in the 265.Em action 266field will be taken. 267.Pp 268Multiple 269.Em selectors 270may be specified for a single 271.Em action 272by separating them with semicolon 273.Pq Dq \&; 274characters. 275It is important to note, however, that each 276.Em selector 277can modify the ones preceding it. 278.Pp 279Multiple 280.Em facilities 281may be specified for a single 282.Em level 283by separating them with comma 284.Pq Dq \&, 285characters. 286.Pp 287An asterisk 288.Pq Dq * 289can be used to specify all 290.Em facilities , 291all 292.Em levels , 293or all 294.Em programs . 295.Pp 296The special 297.Em facility 298.Dq mark 299receives a message at priority 300.Dq info 301every 20 minutes 302(see 303.Xr syslogd 8 ) . 304This is not enabled by a 305.Em facility 306field containing an asterisk. 307.Pp 308The special 309.Em level 310.Dq none 311disables a particular 312.Em facility . 313.Pp 314The 315.Em action 316field of each line specifies the action to be taken when the 317.Em selector 318field selects a message. 319There are five forms: 320.Bl -bullet 321.It 322A pathname (beginning with a leading slash). 323Selected messages are appended to the file. 324.Pp 325To ensure that kernel messages are written to disk promptly, 326.Xr syslogd 8 327calls 328.Xr fsync 2 329after writing messages from the kernel. 330Other messages are not synced explicitly. 331You may prefix a pathname with the minus sign, 332.Dq - , 333to forego syncing the specified file after every kernel message. 334Note that you might lose information if the system crashes 335immediately following a write attempt. 336Nevertheless, using the 337.Dq - 338option may improve performance, 339especially if the kernel is logging many messages. 340.It 341A hostname (preceded by an at 342.Pq Dq @ 343sign). 344Selected messages are forwarded to the 345.Xr syslogd 8 346program on the named host. 347If a port number is added after a colon 348.Pq Ql :\& 349then that port will be used as the destination port 350rather than the usual syslog port. 351.It 352A comma separated list of users. 353Selected messages are written to those users 354if they are logged in. 355.It 356An asterisk. 357Selected messages are written to all logged-in users. 358.It 359A percent sign 360.Pq Dq \&% , 361followed by a pathname (beginning with a leading slash). Selected messages 362are written to a circular log file. 363See 364.Xr clog 8 365for a discussion of circular log files. 366.It 367A vertical bar 368.Pq Dq \&| , 369followed by a command to pipe the selected 370messages to. 371The command is passed to 372.Xr sh 1 373for evaluation, so usual shell metacharacters or input/output 374redirection can occur. 375(Note however that redirecting 376.Xr stdio 3 377buffered output from the invoked command can cause additional delays, 378or even lost output data in case a logging subprocess exited with a 379signal.) 380The command itself runs with 381.Em stdout 382and 383.Em stderr 384redirected to 385.Pa /dev/null . 386Upon receipt of a 387.Dv SIGHUP , 388.Xr syslogd 8 389will close the pipe to the process. 390If the process did not exit 391voluntarily, it will be sent a 392.Dv SIGTERM 393signal after a grace period of up to 60 seconds. 394.Pp 395The command will only be started once data arrives that should be piped 396to it. 397If it exited later, it will be restarted as necessary. 398So if it 399is desired that the subprocess should get exactly one line of input only 400(which can be very resource-consuming if there are a lot of messages 401flowing quickly), this can be achieved by exiting after just one line of 402input. 403If necessary, a script wrapper can be written to this effect. 404.Pp 405Unless the command is a full pipeline, it is probably useful to 406start the command with 407.Em exec 408so that the invoking shell process does not wait for the command to 409complete. 410Warning: the process is started under the UID invoking 411.Xr syslogd 8 , 412normally the superuser. 413.El 414.Pp 415Blank lines and lines whose first non-blank character is a hash 416.Pq Dq # 417character are ignored. 418If 419.Ql # 420is placed in the middle of the line, the 421.Ql # 422character and the rest of the line after it is ignored. 423To prevent special meaning, the 424.Ql # 425character may be escaped with 426.Ql \e ; 427in this case preceding 428.Ql \e 429is removed and 430.Ql # 431is treated as an ordinary character. 432.Sh IMPLEMENTATION NOTES 433The 434.Dq kern 435facility is usually reserved for messages 436generated by the local kernel. 437Other messages logged with facility 438.Dq kern 439are usually translated to facility 440.Dq user . 441This translation can be disabled; 442see 443.Xr syslogd 8 444for details. 445.Sh FILES 446.Bl -tag -width /etc/syslog.conf -compact 447.It Pa /etc/syslog.conf 448.Xr syslogd 8 449configuration file 450.El 451.Sh EXAMPLES 452A configuration file might appear as follows: 453.Bd -literal 454# Log all kernel messages, authentication messages of 455# level notice or higher, and anything of level err or 456# higher to the console. 457# Don't log private authentication messages! 458*.err;kern.*;auth.notice;authpriv.none;mail.crit /dev/console 459 460# Log anything (except mail) of level info or higher. 461# Don't log private authentication messages! 462*.info;mail.none;authpriv.none /var/log/messages 463 464# Log daemon messages at debug level only 465daemon.=debug /var/log/daemon.debug 466 467# The authpriv file has restricted access. 468authpriv.* /var/log/secure 469 470# Log all the mail messages in one place. 471mail.* /var/log/maillog 472 473# Everybody gets emergency messages, plus log them on another 474# machine. 475*.emerg * 476*.emerg @arpa.berkeley.edu 477 478# Root and Eric get alert and higher messages. 479*.alert root,eric 480 481# Save mail and news errors of level err and higher in a 482# special file. 483uucp,news.crit /var/log/spoolerr 484 485# Pipe all authentication messages to a filter. 486auth.* |exec /usr/local/sbin/authfilter 487 488# Save ftpd transactions along with mail and news 489!ftpd 490*.* /var/log/spoolerr 491 492# Log all security messages to a separate file. 493security.* /var/log/security 494 495# Log all writes to /dev/console to a separate file. 496console.* /var/log/console.log 497 498# Log ipfw messages without syncing after every message. 499!ipfw 500*.* -/var/log/ipfw 501.Ed 502.Sh SEE ALSO 503.Xr syslog 3 , 504.Xr syslogd 8 505.Sh BUGS 506The effects of multiple 507.Em selectors 508are sometimes not intuitive. 509For example 510.Dq mail.crit,*.err 511will select 512.Dq mail 513facility messages at the level of 514.Dq err 515or higher, not at the level of 516.Dq crit 517or higher. 518.Pp 519In networked environments, note that not all operating systems 520implement the same set of facilities. 521The facilities 522authpriv, cron, ftp, and ntp that are known to this implementation 523might be absent on the target system. 524Even worse, DEC 525.Ux 526uses facility number 10 (which is authpriv in this implementation) to 527log events for their AdvFS file system. 528