1.\" Copyright (c) 1990, 1991 The Regents of the University of California. 2.\" All rights reserved. 3.\" 4.\" %sccs.include.redist.roff% 5.\" 6.\" @(#)syslog.conf.5 5.3 (Berkeley) 05/10/91 7.\" 8.Dd 9.Dt SYSLOG.CONF 5 10.Os 11.Sh NAME 12.Nm syslog.conf 13.Nd 14.Xr syslogd 8 15configuration file 16.Sh DESCRIPTION 17The 18.Nm syslog.conf 19file is the configuration file for the 20.Xr syslogd 8 21program. 22It consists of lines with two fields: the 23.Em selector 24field which specifies the types of messages and priorities to which the 25line applies, and an 26.Em action 27field which specifies the action to be taken if a message 28.Xr syslogd 29receives matches the selection criteria. 30The 31.Em selector 32field is separated from the 33.Em action 34field by one or more tab characters. 35.Pp 36The 37.Em Selectors 38function 39are encoded as a 40.Em facility , 41a period (``.''), and a 42.Em level , 43with no intervening white-space. 44Both the 45.Em facility 46and the 47.Em level 48are case insensitive. 49.Pp 50The 51.Em facility 52describes the part of the system generating the message, and is one of 53the following keywords: auth, authpriv, cron, daemon, kern, lpr, mail, 54mark, news, syslog, user, uucp and local0 through local7. 55These keywords (with the exception of mark) correspond to the 56similar 57.Dq Dv LOG_ 58values specified to the 59.Xr openlog 3 60and 61.Xr syslog 3 62library routines. 63.Pp 64The 65.Em level 66describes the severity of the message, and is a keyword from the 67following ordered list (higher to lower): emerg, alert, crit, err, 68warning, notice and debug. 69These keywords correspond to the 70similar 71.Pq Dv LOG_ 72values specified to the 73.Xr syslog 74library routine. 75.Pp 76See 77.Xr syslog 3 78for a further descriptions of both the 79.Em facility 80and 81.Em level 82keywords and their significance. 83.Pp 84If a received message matches the specified 85.Em facility 86and is of the specified 87.Em level 88.Em (or a higher level) , 89the action specified in the 90.Em action 91field will be taken. 92.Pp 93Multiple 94.Em selectors 95may be specified for a single 96.Em action 97by separating them with semicolon (``;'') characters. 98It is important to note, however, that each 99.Em selector 100can modify the ones preceding it. 101.Pp 102Multiple 103.Em facilities 104may be specified for a single 105.Em level 106by separating them with comma (``,'') characters. 107.Pp 108An asterisk (``*'') can be used to specify all 109.Em facilities 110or all 111.Em levels . 112.Pp 113The special 114.Em facility 115``mark'' receives a message at priority ``info'' every 20 minutes 116(see 117.Xr syslogd 8 ) . 118This is not enabled by a 119.Em facility 120field containing an asterisk. 121.Pp 122The special 123.Em level 124``none'' disables a particular 125.Em facility . 126.Pp 127The 128.Em action 129field of each line specifies the action to be taken when the 130.Em selector 131field selects a message. 132There are four forms: 133.Bl -bullet 134.It 135A pathname (beginning with a leading slash). 136Selected messages are appended to the file. 137.It 138A hostname (preceded by an at (``@'') sign). 139Selected messages are forwarded to the 140.Xr syslogd 141program on the named host. 142.It 143A comma separated list of users. 144Selected messages are written to those users 145if they are logged in. 146.It 147An asterisk. 148Selected messages are written to all logged-in users. 149.El 150.Pp 151Blank lines and lines whose first non-blank character is a hash (``#'') 152character are ignored. 153.Sh EXAMPLES 154.Pp 155A configuration file might appear as follows: 156.Bd -literal 157# Log all kernel messages, authentication messages of 158# level notice or higher and anything of level err or 159# higher to the console. 160# Don't log private authentication messages! 161*.err;kern.*;auth.notice;authpriv.none /dev/console 162 163# Log anything (except mail) of level info or higher. 164# Don't log private authentication messages! 165*.info;mail.none;authpriv.none /var/log/messages 166 167# The authpriv file has restricted access. 168authpriv.* /var/log/secure 169 170# Log all the mail messages in one place. 171mail.* /var/log/maillog 172 173# Everybody gets emergency messages, plus log them on another 174# machine. 175*.emerg * 176*.emerg @arpa.berkeley.edu 177 178# Root and Eric get alert and higher messages. 179*.alert root,eric 180 181# Save mail and news errors of level err and higher in a 182# special file. 183uucp,news.crit /var/log/spoolerr 184.Ed 185.Sh FILES 186.Bl -tag -width /etc/syslog.conf -compact 187.It Pa /etc/syslog.conf 188The 189.Xr syslogd 8 190configuration file. 191.El 192.Sh BUGS 193The effects of multiple selectors are sometimes not intuitive. 194For example ``mail.crit,*.err'' will select ``mail'' facility messages at 195the level of ``err'' or higher, not at the level of ``crit'' or higher. 196.Sh SEE ALSO 197.Xr syslog 3 , 198.Xr syslogd 8 199.Sh HISTORY 200The 201.Nm syslog.conf 202file format is 203.Ud . 204