1.\" Copyright (c) 1990, 1991 The Regents of the University of California.
2.\" All rights reserved.
3.\"
4.\" %sccs.include.redist.roff%
5.\"
6.\"     @(#)syslog.conf.5	5.3 (Berkeley) 05/10/91
7.\"
8.Dd
9.Dt SYSLOG.CONF 5
10.Os
11.Sh NAME
12.Nm syslog.conf
13.Nd
14.Xr syslogd 8
15configuration file
16.Sh DESCRIPTION
17The
18.Nm syslog.conf
19file is the configuration file for the
20.Xr syslogd 8
21program.
22It consists of lines with two fields: the
23.Em selector
24field which specifies the types of messages and priorities to which the
25line applies, and an
26.Em action
27field which specifies the action to be taken if a message
28.Xr syslogd
29receives matches the selection criteria.
30The
31.Em selector
32field is separated from the
33.Em action
34field by one or more tab characters.
35.Pp
36The
37.Em Selectors
38function
39are encoded as a
40.Em facility ,
41a period (``.''), and a
42.Em level ,
43with no intervening white-space.
44Both the
45.Em facility
46and the
47.Em level
48are case insensitive.
49.Pp
50The
51.Em facility
52describes the part of the system generating the message, and is one of
53the following keywords: auth, authpriv, cron, daemon, kern, lpr, mail,
54mark, news, syslog, user, uucp and local0 through local7.
55These keywords (with the exception of mark) correspond to the
56similar
57.Dq Dv LOG_
58values specified to the
59.Xr openlog 3
60and
61.Xr syslog 3
62library routines.
63.Pp
64The
65.Em level
66describes the severity of the message, and is a keyword from the
67following ordered list (higher to lower): emerg, alert, crit, err,
68warning, notice and debug.
69These keywords correspond to the
70similar
71.Pq Dv LOG_
72values specified to the
73.Xr syslog
74library routine.
75.Pp
76See
77.Xr syslog 3
78for a further descriptions of both the
79.Em facility
80and
81.Em level
82keywords and their significance.
83.Pp
84If a received message matches the specified
85.Em facility
86and is of the specified
87.Em level
88.Em (or a higher level) ,
89the action specified in the
90.Em action
91field will be taken.
92.Pp
93Multiple
94.Em selectors
95may be specified for a single
96.Em action
97by separating them with semicolon (``;'') characters.
98It is important to note, however, that each
99.Em selector
100can modify the ones preceding it.
101.Pp
102Multiple
103.Em facilities
104may be specified for a single
105.Em level
106by separating them with comma (``,'') characters.
107.Pp
108An asterisk (``*'') can be used to specify all
109.Em facilities
110or all
111.Em levels .
112.Pp
113The special
114.Em facility
115``mark'' receives a message at priority ``info'' every 20 minutes
116(see
117.Xr syslogd 8 ) .
118This is not enabled by a
119.Em facility
120field containing an asterisk.
121.Pp
122The special
123.Em level
124``none'' disables a particular
125.Em facility .
126.Pp
127The
128.Em action
129field of each line specifies the action to be taken when the
130.Em selector
131field selects a message.
132There are four forms:
133.Bl -bullet
134.It
135A pathname (beginning with a leading slash).
136Selected messages are appended to the file.
137.It
138A hostname (preceded by an at (``@'') sign).
139Selected messages are forwarded to the
140.Xr syslogd
141program on the named host.
142.It
143A comma separated list of users.
144Selected messages are written to those users
145if they are logged in.
146.It
147An asterisk.
148Selected messages are written to all logged-in users.
149.El
150.Pp
151Blank lines and lines whose first non-blank character is a hash (``#'')
152character are ignored.
153.Sh EXAMPLES
154.Pp
155A configuration file might appear as follows:
156.Bd -literal
157# Log all kernel messages, authentication messages of
158# level notice or higher and anything of level err or
159# higher to the console.
160# Don't log private authentication messages!
161*.err;kern.*;auth.notice;authpriv.none	/dev/console
162
163# Log anything (except mail) of level info or higher.
164# Don't log private authentication messages!
165*.info;mail.none;authpriv.none		/var/log/messages
166
167# The authpriv file has restricted access.
168authpriv.*						/var/log/secure
169
170# Log all the mail messages in one place.
171mail.*							/var/log/maillog
172
173# Everybody gets emergency messages, plus log them on another
174# machine.
175*.emerg							*
176*.emerg							@arpa.berkeley.edu
177
178# Root and Eric get alert and higher messages.
179*.alert							root,eric
180
181# Save mail and news errors of level err and higher in a
182# special file.
183uucp,news.crit						/var/log/spoolerr
184.Ed
185.Sh FILES
186.Bl -tag -width /etc/syslog.conf -compact
187.It Pa /etc/syslog.conf
188The
189.Xr syslogd 8
190configuration file.
191.El
192.Sh BUGS
193The effects of multiple selectors are sometimes not intuitive.
194For example ``mail.crit,*.err'' will select ``mail'' facility messages at
195the level of ``err'' or higher, not at the level of ``crit'' or higher.
196.Sh SEE ALSO
197.Xr syslog 3 ,
198.Xr syslogd 8
199.Sh HISTORY
200The
201.Nm syslog.conf
202file format is
203.Ud .
204