1.\" Copyright (c) 1990, 1991, 1993 2.\" The Regents of the University of California. All rights reserved. 3.\" 4.\" Redistribution and use in source and binary forms, with or without 5.\" modification, are permitted provided that the following conditions 6.\" are met: 7.\" 1. Redistributions of source code must retain the above copyright 8.\" notice, this list of conditions and the following disclaimer. 9.\" 2. Redistributions in binary form must reproduce the above copyright 10.\" notice, this list of conditions and the following disclaimer in the 11.\" documentation and/or other materials provided with the distribution. 12.\" 3. Neither the name of the University nor the names of its contributors 13.\" may be used to endorse or promote products derived from this software 14.\" without specific prior written permission. 15.\" 16.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 17.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 20.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 21.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 22.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 23.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 24.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 25.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26.\" SUCH DAMAGE. 27.\" 28.\" from: @(#)syslog.conf.5 8.1 (Berkeley) 6/9/93 29.\" $OpenBSD: syslog.conf.5,v 1.39 2019/01/13 11:07:47 schwarze Exp $ 30.\" $NetBSD: syslog.conf.5,v 1.4 1996/01/02 17:41:46 perry Exp $ 31.\" 32.Dd $Mdocdate: January 13 2019 $ 33.Dt SYSLOG.CONF 5 34.Os 35.Sh NAME 36.Nm syslog.conf 37.Nd syslogd(8) configuration file 38.Sh DESCRIPTION 39The 40.Nm syslog.conf 41file is the configuration file for the 42.Xr syslogd 8 43program. 44It consists of blocks of lines separated by 45.Em program 46specifications, with each line containing two fields: the 47.Em selector 48field which specifies the types of messages and priorities to which the 49line applies, and an 50.Em action 51field which specifies the action to be taken if a message 52.Xr syslogd 8 53receives matches the selection criteria. 54The 55.Em selector 56field is separated from the 57.Em action 58field by one or more tab or space characters. 59.Pp 60The 61.Em selectors 62are encoded as a 63.Em facility , 64a period 65.Pq Ql \&. , 66and a 67.Em level , 68with no intervening whitespace. 69Both the 70.Em facility 71and the 72.Em level 73are case insensitive. 74.Pp 75The 76.Em facility 77describes the part of the system generating the message, and is one of 78the following keywords: auth, authpriv, cron, daemon, ftp, kern, lpr, mail, 79mark, news, syslog, user, uucp and local0 through local7. 80These keywords (with the exception of mark) correspond to the 81similar 82.Dq Dv LOG_ 83values specified to the 84.Xr openlog 3 85and 86.Xr syslog 3 87library routines. 88.Pp 89The 90.Em level 91describes the severity of the message, and is a keyword from the 92following ordered list (highest to lowest): emerg, alert, crit, err, 93warning, notice, info and debug. 94These keywords correspond to the 95similar 96.Pq Dv LOG_ 97values specified to the 98.Xr syslog 3 99library routine. 100.Pp 101Each block of lines is separated from the previous block by a tag. 102The tag is a line beginning with 103.Em !prog 104and each block will be associated with calls to syslog from that specific 105program (matched using 106.Xr glob 7 107rules). 108When a message matches multiple blocks, the action of each matching 109block is taken. 110If no tag is specified at the beginning of the file, 111every line is checked for a match and acted upon 112.Pq at least until a tag is found . 113.Pp 114.Em !!prog 115causes the subsequent block to abort evaluation when a message matches, 116ensuring that only a single set of actions is taken. 117.Em !*\& 118can be used to ensure that any ensuing blocks are further evaluated 119(i.e. cancelling the effect of a 120.Em !prog 121or 122.Em !!prog ) . 123.Pp 124Blocks starting with 125.Em +host 126or 127.Em ++host 128or 129.Em +* 130work the same way as their 131.Em prog 132counterparts, but they match on the hostname instead of the program 133name. 134.Pp 135See 136.Xr syslog 3 137for further descriptions of both the 138.Em facility 139and 140.Em level 141keywords and their significance. 142It's recommended that selections be made on 143.Em facility 144rather than 145.Em program , 146since the latter can easily vary in a networked environment. 147In some cases, though, an appropriate 148.Em facility 149simply doesn't exist. 150.Pp 151If a received message matches the specified 152.Em facility 153and is of the specified 154.Em level 155.Pq Em or a higher level , 156and the first word in the message after the date matches the 157.Em program , 158the action specified in the 159.Em action 160field will be taken. 161In this context, 162.Xr ascii 7 163letters, digits, hyphens 164.Pq Sq - , 165periods 166.Pq Sq \&. , 167and underscores 168.Pq Sq _ 169can be contained in a word; other bytes end the word. 170.Pp 171Multiple 172.Em selectors 173may be specified for a single 174.Em action 175by separating them with semicolon 176.Pq Ql \&; 177characters. 178It is important to note, however, that each 179.Em selector 180can modify the ones preceding it. 181.Pp 182Multiple 183.Em facilities 184may be specified for a single 185.Em level 186by separating them with comma 187.Pq Ql \&, 188characters. 189.Pp 190An asterisk 191.Pq Ql * 192can be used to specify all 193.Em facilities , 194all 195.Em levels 196or all 197.Em programs . 198.Pp 199The special 200.Em facility 201.Dq mark 202receives a message at priority 203.Dq info 204every 20 minutes (see 205.Xr syslogd 8 ) . 206This is not enabled by a 207.Em facility 208field containing an asterisk. 209.Pp 210The special 211.Em level 212.Dq none 213disables a particular 214.Em facility . 215.Pp 216The 217.Em action 218field of each line specifies the action to be taken when the 219.Em selector 220field selects a message. 221There are six forms: 222.Bl -bullet 223.It 224A pathname (beginning with a leading slash). 225Selected messages are appended to the file. 226.It 227A pipe to another program (beginning with a leading pipe symbol). 228The given program is started and presented the selected messages 229on its standard input. 230If the program exits, 231.Xr syslogd 8 232tries to restart it. 233.It 234A hostname (preceded by an at 235.Pq Ql @ 236sign). 237Selected messages are forwarded to the 238.Xr syslogd 8 239program on the named host. 240A port number may be specified using the 241.Ar host:port 242syntax. 243This is optional for UDP and TLS. 244There is no well-known port for syslog over TCP, so in this case it 245is mandatory to specify the port. 246IPv6 addresses can be used by surrounding the address portion with 247square brackets 248.Po 249.Ql [\& 250and 251.Ql ]\& 252.Pc . 253A prefix udp4:// or udp6:// in front of the hostname and after the 254at sign will force IPv4 or IPv6 addresses for UDP transport. 255The prefixes tcp[46]:// or tls[46]:// send messages over TCP or 256TLS, respectively, with an optional IP version 4 or 6. 257.It 258A comma separated list of users. 259Selected messages are written to those users 260if they are logged in. 261.It 262An asterisk. 263Selected messages are written to all logged-in users. 264.It 265A colon, followed by a memory buffer size 266.Pq in kilobytes , 267followed by another colon, followed by a buffer name. 268Selected messages are written to an in-memory buffer that may be read using 269.Xr syslogc 8 . 270Memory buffered logging is useful to provide access to log data on devices 271that lack local storage (e.g. diskless workstations or routers). 272The largest allowed buffer size is 256kb. 273.El 274.Pp 275Blank lines and lines whose first non-blank character is a hash 276.Pq Ql # 277character are ignored. 278.Sh FILES 279.Bl -tag -width /etc/syslog.conf -compact 280.It Pa /etc/syslog.conf 281The 282.Xr syslogd 8 283configuration file. 284.El 285.Sh EXAMPLES 286A configuration file might appear as follows: 287.Bd -literal 288# Log info (and higher) messages from spamd only to 289# a dedicated file, discarding debug messages. 290# Matching messages abort evaluation of further rules. 291!!spamd 292daemon.info /var/log/spamd 293daemon.debug /dev/null 294!* 295 296# Log all kernel messages, authentication messages of 297# level notice or higher and anything of level err or 298# higher to the console. 299# Don't log private authentication messages! 300*.err;kern.*;auth.notice;authpriv.none /dev/console 301 302# Log anything (except mail) of level info or higher. 303# Don't log private authentication messages! 304*.info;mail.none;authpriv.none /var/log/messages 305 306# The authpriv file has restricted access. 307authpriv.* /var/log/secure 308 309# Log all the mail messages in one place. 310mail.* /var/log/maillog 311 312# Everybody gets emergency messages, plus log them on another 313# machine. 314*.emerg * 315*.emerg @arpa.berkeley.edu 316 317# Root and Eric get alert and higher messages. 318*.alert root,eric 319 320# Log everything coming from host bastion to a separate file. 321++bastion 322*.* /var/log/bastion 323+* 324 325# Save mail and news errors of level err and higher in a 326# special file. 327mail,news.err /var/log/spoolerr 328 329# Save ftpd transactions along with mail and news. 330!ftpd 331*.* /var/log/spoolerr 332 333# Keep a copy of all logging in a 32k memory buffer named "debug". 334*.debug :32:debug 335 336# Store notices and authpriv messages in a 64k buffer named "important". 337*.notice,authpriv.* :64:important 338 339# Feed everything to logsurfer. 340*.* |/usr/local/sbin/logsurfer 341.Ed 342.Sh SEE ALSO 343.Xr syslog 3 , 344.Xr syslogc 8 , 345.Xr syslogd 8 346.Sh HISTORY 347The 348.Nm 349file appeared in 350.Bx 4.3 , 351along with 352.Xr syslogd 8 . 353.Pp 354Historic versions of 355.Xr syslogd 8 356did not support space-delimited fields. 357.Sh BUGS 358The effects of multiple selectors are sometimes not intuitive. 359For example 360.Dq mail.crit;*.err 361will select 362.Dq mail 363facility messages at the level of 364.Dq err 365or higher, not at the level of 366.Dq crit 367or higher. 368