1.\" Copyright (c) 1990, 1991, 1993 2.\" The Regents of the University of California. All rights reserved. 3.\" 4.\" Redistribution and use in source and binary forms, with or without 5.\" modification, are permitted provided that the following conditions 6.\" are met: 7.\" 1. Redistributions of source code must retain the above copyright 8.\" notice, this list of conditions and the following disclaimer. 9.\" 2. Redistributions in binary form must reproduce the above copyright 10.\" notice, this list of conditions and the following disclaimer in the 11.\" documentation and/or other materials provided with the distribution. 12.\" 3. Neither the name of the University nor the names of its contributors 13.\" may be used to endorse or promote products derived from this software 14.\" without specific prior written permission. 15.\" 16.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 17.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 20.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 21.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 22.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 23.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 24.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 25.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26.\" SUCH DAMAGE. 27.\" 28.\" @(#)syslog.conf.5 8.1 (Berkeley) 6/9/93 29.\" $FreeBSD$ 30.\" 31.Dd March 26, 2020 32.Dt SYSLOG.CONF 5 33.Os 34.Sh NAME 35.Nm syslog.conf 36.Nd 37.Xr syslogd 8 38configuration file 39.Sh DESCRIPTION 40The 41.Nm 42file is the configuration file for the 43.Xr syslogd 8 44program. 45It consists of 46blocks of lines separated by 47.Em program , 48.Em hostname 49or 50.Em property-based filter 51specifications (separations appear alone on their lines), 52with each line containing two fields: the 53.Em selector 54field which specifies the types of messages and priorities to which the 55line applies, and an 56.Em action 57field which specifies the action to be taken if a message 58.Xr syslogd 8 59receives matches the selection criteria. 60The 61.Em selector 62field is separated from the 63.Em action 64field by one or more tab characters or spaces. 65.Pp 66A special 67.Em include 68keyword can be used to include all files with names ending in '.conf' and not 69beginning with a '.' contained in the directory following the keyword. 70This keyword can only be used in the first level configuration file. 71.Pp 72Note that if you use spaces as separators, your 73.Nm 74might be incompatible with other Unices or Unix-like systems. 75This functionality was added for ease of configuration 76(e.g.\& it is possible to cut-and-paste into 77.Nm ) , 78and to avoid possible mistakes. 79This change however preserves 80backwards compatibility with the old style of 81.Nm 82(i.e., tab characters only). 83.Pp 84The 85.Em selectors 86are encoded as a 87.Em facility , 88a period 89.Pq Dq \&. , 90an optional set of comparison flags 91.Pq Oo \&! Oc Op <=> , 92and a 93.Em level , 94with no intervening white-space. 95Both the 96.Em facility 97and the 98.Em level 99are case insensitive. 100.Pp 101The 102.Em facility 103describes the part of the system generating the message, and is one of 104the following keywords: 105.Cm auth , authpriv , console , cron , daemon , ftp , kern , lpr , 106.Cm mail , mark , news , ntp , security , syslog , user , uucp , 107and 108.Cm local0 109through 110.Cm local7 . 111These keywords (with the exception of mark) correspond to 112similar 113.Dq Dv LOG_ 114values specified to the 115.Xr openlog 3 116and 117.Xr syslog 3 118library routines. 119.Pp 120The 121.Em comparison flags 122may be used to specify exactly what is logged. 123The default comparison is 124.Dq => 125(or, if you prefer, 126.Dq >= ) , 127which means that messages from the specified 128.Em facility 129list, and of a priority 130level equal to or greater than 131.Em level 132will be logged. 133Comparison flags beginning with 134.Dq Li \&! 135will have their logical sense inverted. 136Thus 137.Dq !=info 138means all levels except info and 139.Dq !notice 140has the same meaning as 141.Dq <notice . 142.Pp 143The 144.Em level 145describes the severity of the message, and is a keyword from the 146following ordered list (higher to lower): 147.Cm emerg , crit , alert , err , warning , notice , info 148and 149.Cm debug . 150These keywords correspond to 151similar 152.Dq Dv LOG_ 153values specified to the 154.Xr syslog 3 155library routine. 156.Pp 157Each block of lines is separated from the previous block by a 158.Em program , 159.Em hostname 160or 161.Em property-based filter 162specification. 163A block will only log messages corresponding to the most recent 164.Em program , 165.Em hostname 166and 167.Em property-based filter 168specifications given. 169Thus, with a block which selects 170.Ql ppp 171as the 172.Em program , 173directly followed by a block that selects messages from the 174.Em hostname 175.Ql dialhost , 176the second block will only log messages 177from the 178.Xr ppp 8 179program on dialhost. 180.Pp 181A 182.Em program 183specification is a line beginning with 184.Ql #!prog 185or 186.Ql !prog 187(the former is for compatibility with the previous syslogd, if one is sharing 188.Nm 189files, for example) 190and the following blocks will be associated with calls to 191.Xr syslog 3 192from that specific program. 193A 194.Em program 195specification for 196.Ql foo 197will also match any message logged by the kernel with the prefix 198.Ql "foo: " . 199The 200.Ql #!+prog 201or 202.Ql !+prog 203specification works just like the previous one, 204and the 205.Ql #!-prog 206or 207.Ql !-prog 208specification will match any message but the ones from that 209program. 210Multiple programs may be listed, separated by commas: 211.Ql !prog1,prog2 212matches messages from either program, while 213.Ql !-prog1,prog2 214matches all messages but those from 215.Ql prog1 216or 217.Ql prog2 . 218.Pp 219A 220.Em hostname 221specification of the form 222.Ql #+hostname 223or 224.Ql +hostname 225means the following blocks will be applied to messages 226received from the specified hostname. 227Alternatively, the 228.Em hostname 229specification 230.Ql #-hostname 231or 232.Ql -hostname 233causes the following blocks to be applied to messages 234from any host but the one specified. 235If the hostname is given as 236.Ql @ , 237the local hostname will be used. 238As for program specifications, multiple comma-separated 239values may be specified for hostname specifications. 240.Pp 241A 242.Em property-based filter 243specification is a line beginning with 244.Ql #: 245or 246.Ql \&: 247and the following blocks will be applied only when filter value 248matches given filter propertie's value. See 249.Sx PROPERTY-BASED FILTERS 250section for more details. 251.Pp 252A 253.Em program , 254.Em hostname 255or 256.Em property-based filter 257specification may be reset by giving 258.Ql * 259as an argument. 260.Pp 261See 262.Xr syslog 3 263for further descriptions of both the 264.Em facility 265and 266.Em level 267keywords and their significance. 268It is preferred that selections be made on 269.Em facility 270rather than 271.Em program , 272since the latter can easily vary in a networked environment. 273In some cases, 274though, an appropriate 275.Em facility 276simply does not exist. 277.Pp 278If a received message matches the specified 279.Em facility 280and is of the specified 281.Em level 282.Em (or a higher level) , 283and the first word in the message after the date matches the 284.Em program , 285the action specified in the 286.Em action 287field will be taken. 288.Pp 289Multiple 290.Em selectors 291may be specified for a single 292.Em action 293by separating them with semicolon 294.Pq Dq \&; 295characters. 296It is important to note, however, that each 297.Em selector 298can modify the ones preceding it. 299.Pp 300Multiple 301.Em facilities 302may be specified for a single 303.Em level 304by separating them with comma 305.Pq Dq \&, 306characters. 307.Pp 308An asterisk 309.Pq Dq * 310can be used to specify all 311.Em facilities , 312all 313.Em levels , 314or all 315.Em programs . 316.Pp 317The special 318.Em facility 319.Dq mark 320receives a message at priority 321.Dq info 322every 20 minutes 323(see 324.Xr syslogd 8 ) . 325This is not enabled by a 326.Em facility 327field containing an asterisk. 328.Pp 329The special 330.Em level 331.Dq none 332disables a particular 333.Em facility . 334.Pp 335The 336.Em action 337field of each line specifies the action to be taken when the 338.Em selector 339field selects a message. 340There are five forms: 341.Bl -bullet 342.It 343A pathname (beginning with a leading slash). 344Selected messages are appended to the file. 345.Pp 346To ensure that kernel messages are written to disk promptly, 347.Nm 348calls 349.Xr fsync 2 350after writing messages from the kernel. 351Other messages are not synced explicitly. 352You may prefix a pathname with the minus sign, 353.Dq - , 354to forego syncing the specified file after every kernel message. 355Note that you might lose information if the system crashes 356immediately following a write attempt. 357Nevertheless, using the 358.Dq - 359option may improve performance, 360especially if the kernel is logging many messages. 361.It 362A hostname (preceded by an at 363.Pq Dq @ 364sign). 365Selected messages are forwarded to the 366.Xr syslogd 8 367program on the named host. 368If a port number is added after a colon 369.Pq Ql :\& 370then that port will be used as the destination port 371rather than the usual syslog port. 372IPv6 addresses can be used 373by surrounding the address portion with 374square brackets 375.Po 376.Ql [\& 377and 378.Ql ]\& 379.Pc . 380.It 381A comma separated list of users. 382Selected messages are written to those users 383if they are logged in. 384.It 385An asterisk. 386Selected messages are written to all logged-in users. 387.It 388A vertical bar 389.Pq Dq \&| , 390followed by a command to pipe the selected 391messages to. 392The command is passed to 393.Xr sh 1 394for evaluation, so usual shell metacharacters or input/output 395redirection can occur. 396(Note however that redirecting 397.Xr stdio 3 398buffered output from the invoked command can cause additional delays, 399or even lost output data in case a logging subprocess exited with a 400signal.) 401The command itself runs with 402.Em stdout 403and 404.Em stderr 405redirected to 406.Pa /dev/null . 407Upon receipt of a 408.Dv SIGHUP , 409.Xr syslogd 8 410will close the pipe to the process. 411If the process did not exit 412voluntarily, it will be sent a 413.Dv SIGTERM 414signal after a grace period of up to 60 seconds. 415.Pp 416The command will only be started once data arrives that should be piped 417to it. 418If it exited later, it will be restarted as necessary. 419So if it 420is desired that the subprocess should get exactly one line of input only 421(which can be very resource-consuming if there are a lot of messages 422flowing quickly), this can be achieved by exiting after just one line of 423input. 424If necessary, a script wrapper can be written to this effect. 425.Pp 426Unless the command is a full pipeline, it is probably useful to 427start the command with 428.Em exec 429so that the invoking shell process does not wait for the command to 430complete. 431Warning: the process is started under the UID invoking 432.Xr syslogd 8 , 433normally the superuser. 434.El 435.Pp 436Blank lines and lines whose first non-blank character is a hash 437.Pq Dq # 438character are ignored. 439If 440.Ql # 441is placed in the middle of the line, the 442.Ql # 443character and the rest of the line after it is ignored. 444To prevent special meaning, the 445.Ql # 446character may be escaped with 447.Ql \e ; 448in this case preceding 449.Ql \e 450is removed and 451.Ql # 452is treated as an ordinary character. 453.Sh PROPERTY-BASED FILTERS 454.Em program , 455.Em hostname 456specifications performs exact match filtering against explicit field only. 457.Em Property-based filters 458feature substring and regular expressions (see 459.Xr re_format 7 ) 460matching against various message attributes. 461Filter specification starts with 462.Ql #: 463or 464.Ql \&: 465followed by three comma-separated fields 466.Em property , operator , \&"value\&" . 467Value must be double-quoted. A double quote and backslash must be escaped by 468a backslash. 469.Pp 470Following 471.Em properties 472are supported as test value: 473.Pp 474.Bl -bullet -compact 475.It 476.Ql msg 477- body of the message received. 478.It 479.Ql programname 480- program name sent the message 481.It 482.Ql hostname 483- hostname of message's originator 484.It 485.Ql source 486- an alias for hostname 487.El 488.Pp 489Operator specifies a comparison function between 490.Em propertie's 491 value against filter's value. 492Possible operators: 493.Pp 494.Bl -bullet -compact 495.It 496.Ql contains 497- true if filter value is found as a substring of 498.Em property 499.It 500.Ql isequal 501- true if filter value is equal to 502.Em property 503.It 504.Ql startswith 505- true if property starts with filter value 506.It 507.Ql regex 508- true if property matches basic regular expression defined in filter value 509.It 510.Ql ereregex 511- true if property matches extended regular expression defined in filter value 512.El 513.Pp 514Operator may be prefixed by 515.Pp 516.Bl -bullet -compact 517.It 518.Ql \&! 519- to invert compare logic 520.It 521.Ql icase_ 522- to make comparison function case insensitive 523.El 524.Pp 525.Sh IMPLEMENTATION NOTES 526The 527.Dq kern 528facility is usually reserved for messages 529generated by the local kernel. 530Other messages logged with facility 531.Dq kern 532are usually translated to facility 533.Dq user . 534This translation can be disabled; 535see 536.Xr syslogd 8 537for details. 538.Sh FILES 539.Bl -tag -width /etc/syslog.conf -compact 540.It Pa /etc/syslog.conf 541.Xr syslogd 8 542configuration file 543.El 544.Sh EXAMPLES 545A configuration file might appear as follows: 546.Bd -literal 547# Log all kernel messages, authentication messages of 548# level notice or higher, and anything of level err or 549# higher to the console. 550# Don't log private authentication messages! 551*.err;kern.*;auth.notice;authpriv.none;mail.crit /dev/console 552 553# Log anything (except mail) of level info or higher. 554# Don't log private authentication messages! 555*.info;mail.none;authpriv.none /var/log/messages 556 557# Log daemon messages at debug level only 558daemon.=debug /var/log/daemon.debug 559 560# The authpriv file has restricted access. 561authpriv.* /var/log/secure 562 563# Log all the mail messages in one place. 564mail.* /var/log/maillog 565 566# Everybody gets emergency messages, plus log them on another 567# machine. 568*.emerg * 569*.emerg @arpa.berkeley.edu 570 571# Root and Eric get alert and higher messages. 572*.alert root,eric 573 574# Save mail and news errors of level err and higher in a 575# special file. 576uucp,news.crit /var/log/spoolerr 577 578# Pipe all authentication messages to a filter. 579auth.* |exec /usr/local/sbin/authfilter 580 581# Log all security messages to a separate file. 582security.* /var/log/security 583 584# Log all writes to /dev/console to a separate file. 585console.* /var/log/console.log 586 587# Save ftpd transactions along with mail and news 588!ftpd 589*.* /var/log/spoolerr 590 591# Log ipfw messages without syncing after every message. 592!ipfw 593*.* -/var/log/ipfw 594 595# Log ipfw messages with "Deny" in the message body. 596:msg, contains, ".*Deny.*" 597*.* /var/log/ipfw.deny 598 599# Reset program name filtering 600!* 601 602# Log messages from bird or bird6 into one file 603:processname, regex, "^bird6?$" 604*.* /var/log/bird-all.log 605 606# Log messages from servers in racks 10-19 in multiple locations, case insensitive 607:hostname, icase_ereregex, "^server-(dcA|podB|cdn)-rack1[0-9]{2}\\..*" 608*.* /var/log/racks10..19.log 609.Ed 610.Sh SEE ALSO 611.Xr syslog 3 , 612.Xr syslogd 8 613.Sh BUGS 614The effects of multiple 615.Em selectors 616are sometimes not intuitive. 617For example 618.Dq mail.crit,*.err 619will select 620.Dq mail 621facility messages at the level of 622.Dq err 623or higher, not at the level of 624.Dq crit 625or higher. 626.Pp 627In networked environments, note that not all operating systems 628implement the same set of facilities. 629The facilities 630authpriv, cron, ftp, and ntp that are known to this implementation 631might be absent on the target system. 632Even worse, DEC UNIX uses 633facility number 10 (which is authpriv in this implementation) to 634log events for their AdvFS file system. 635