'\" te
.\" Copyright (c) 2013 Gary Mills
.\" Copyright (c) 2003 Sun Microsystems, Inc. All Rights Reserved.
.\" Copyright (c) 1983 Regents of the University of California.  All rights reserved.  The Berkeley software License Agreement  specifies the terms and conditions for redistribution.
.TH SYSLOG.CONF 4 "Nov 19, 2013"
.SH NAME
syslog.conf \- configuration file for syslogd system log daemon
.SH SYNOPSIS
.LP
.nf
\fB/etc/syslog.conf\fR
.fi

.SH DESCRIPTION
.LP
The file \fB/etc/syslog.conf\fR contains information used by the system log
daemon, \fBsyslogd\fR(1M), to forward a system message to appropriate log files
and/or users. \fBsyslogd\fR preprocesses this file through \fBm4\fR(1) to
obtain the correct information for certain log files, defining \fBLOGHOST\fR if
the address of "loghost" is the same as one of the addresses of the host that
is running \fBsyslogd\fR.
.sp
.LP
A configuration entry is composed of two TAB-separated fields:
.sp
.in +2
.nf
\fIselector		action\fR
.fi
.in -2

.sp
.LP
The \fIselector\fR field contains a semicolon-separated list of priority
specifications of the form:
.sp
.in +2
.nf
\fIfacility\fR\fB\&.\fR\fIlevel\fR [ \fB;\fR \fIfacility\fR\fB\&.\fR\fIlevel\fR ]
.fi
.in -2

.sp
.LP
where \fIfacility\fR is a system facility, or comma-separated list of
facilities, and \fIlevel\fR is an indication of the severity of the condition
being logged.
The presence of a facility name only implies that it is available.
Each individual service determines which facility it will use for logging.
In particular, many facilities are only useful for \fBsyslog\fR messages
that are forwarded from other operating systems.
Recognized values for \fIfacility\fR include:
.sp
.ne 2
.na
\fB\fBkern\fR\fR
.ad
.RS 12n
Messages generated by the kernel.
.RE

.sp
.ne 2
.na
\fB\fBuser\fR\fR
.ad
.RS 12n
Messages generated by user processes. This is the default priority for messages
from programs or facilities not listed in this file.
.RE

.sp
.ne 2
.na
\fB\fBmail\fR\fR
.ad
.RS 12n
The mail system.
.RE

.sp
.ne 2
.na
\fB\fBdaemon\fR\fR
.ad
.RS 12n
Various system daemons.
.RE

.sp
.ne 2
.na
\fB\fBauth\fR\fR
.ad
.RS 12n
The authorization system: \fBlogin\fR(1), \fBsu\fR(1M), \fBgetty\fR(1M), among
others.
.RE

.sp
.ne 2
.na
\fB\fBlpr\fR\fR
.ad
.RS 12n
The line printer spooling system: \fBlpr\fR(1B), \fBlpc\fR(1B), among others.
.RE

.sp
.ne 2
.na
\fB\fBnews\fR\fR
.ad
.RS 12n
Designated for the USENET network news system.
.RE

.sp
.ne 2
.na
\fB\fBuucp\fR\fR
.ad
.RS 12n
Designated for the UUCP system; it does not currently use the \fBsyslog\fR
mechanism.
.RE

.sp
.ne 2
.na
\fB\fBaltcron\fR\fR
.ad
.RS 12n
Designated for the BSD cron/at system.
.RE

.sp
.ne 2
.na
\fB\fBauthpriv\fR\fR
.ad
.RS 12n
Designated for the BSD security/authorization system.
.RE

.sp
.ne 2
.na
\fB\fBftp\fR\fR
.ad
.RS 12n
Designated for the file transfer system.
.RE

.sp
.ne 2
.na
\fB\fBntp\fR\fR
.ad
.RS 12n
Designated for the network time system.
.RE

.sp
.ne 2
.na
\fB\fBaudit\fR\fR
.ad
.RS 12n
Designated for audit messages generated by systems that audit by means of
syslog.
.RE

.sp
.ne 2
.na
\fB\fBconsole\fR\fR
.ad
.RS 12n
Designated for the BSD console system.
.RE

.sp
.ne 2
.na
\fB\fBcron\fR\fR
.ad
.RS 12n
Designated for \fBcron\fR/\fBat\fR messages generated by systems that do
logging through \fBsyslog\fR.
The current versions of \fBcron\fR and \fBat\fR do not use this facility
for logging.
.RE

.sp
.ne 2
.na
\fB\fBlocal0-7\fR\fR
.ad
.RS 12n
Designated for local use.
.RE

.sp
.ne 2
.na
\fB\fBmark\fR\fR
.ad
.RS 12n
For timestamp messages produced internally by \fBsyslogd\fR.
.RE

.sp
.ne 2
.na
\fB\fB*\fR\fR
.ad
.RS 12n
An asterisk indicates all facilities except for the \fBmark\fR facility.
.RE

.sp
.LP
Recognized values for \fIlevel\fR are (in descending order of severity):
.sp
.ne 2
.na
\fB\fBemerg\fR\fR
.ad
.RS 11n
For panic conditions that would normally be broadcast to all users.
.RE

.sp
.ne 2
.na
\fB\fBalert\fR\fR
.ad
.RS 11n
For conditions that should be corrected immediately, such as a corrupted system
database.
.RE

.sp
.ne 2
.na
\fB\fBcrit\fR\fR
.ad
.RS 11n
For warnings about critical conditions, such as hard device errors.
.RE

.sp
.ne 2
.na
\fB\fBerr\fR\fR
.ad
.RS 11n
For other errors.
.RE

.sp
.ne 2
.na
\fB\fBwarning\fR\fR
.ad
.RS 11n
For warning messages.
.RE

.sp
.ne 2
.na
\fB\fBnotice\fR\fR
.ad
.RS 11n
For conditions that are not error conditions, but may require special handling.
A configuration entry with a \fIlevel\fR value of \fBnotice\fR must appear on a
separate line.
.RE

.sp
.ne 2
.na
\fB\fBinfo\fR\fR
.ad
.RS 11n
Informational messages.
.RE

.sp
.ne 2
.na
\fB\fBdebug\fR\fR
.ad
.RS 11n
For messages that are normally used only when debugging a program.
.RE

.sp
.ne 2
.na
\fB\fBnone\fR\fR
.ad
.RS 11n
Do not send messages from the indicated \fIfacility\fR to the selected file.
For example, a \fIselector\fR of
.sp
\fB*.debug;mail.none\fR
.sp
sends all messages \fIexcept\fR mail messages to the selected file.
.RE

.sp
.LP
For a given \fIfacility\fR and \fIlevel\fR, \fBsyslogd\fR matches all messages
for that level and all higher levels. For example, an entry that specifies a
level of \fBcrit\fR also logs messages at the \fBalert\fR and \fBemerg\fR
levels.
.sp
.LP
The \fIaction\fR field indicates where to forward the message. Values for this
field can have one of four forms:
.RS +4
.TP
.ie t \(bu
.el o
A filename, beginning with a leading slash, which indicates that messages
specified by the \fIselector\fR are to be written to the specified file. The
file is opened in append mode if it exists. If the file does not exist, logging
silently fails for this action.
.RE
.RS +4
.TP
.ie t \(bu
.el o
The name of a remote host, prefixed with an \fB@\fR, as with:
\fB@\fR\fIserver\fR, which indicates that messages specified by the
\fIselector\fR are to be forwarded to the \fBsyslogd\fR on the named host. The
hostname "loghost" is treated, in the default \fBsyslog.conf\fR, as the
hostname given to the machine that logs \fBsyslogd\fR messages. Every machine
is "loghost" by default, per the hosts database. It is also possible to specify
one machine on a network to be "loghost" by, literally, naming the machine
"loghost". If the local machine is designated to be "loghost", then
\fBsyslogd\fR messages are written to the appropriate files. Otherwise, they
are sent to the machine "loghost" on the network.
.RE
.RS +4
.TP
.ie t \(bu
.el o
A comma-separated list of usernames, which indicates that messages specified by
the \fIselector\fR are to be written to the named users if they are logged in.
.RE
.RS +4
.TP
.ie t \(bu
.el o
An asterisk, which indicates that messages specified by the \fIselector\fR are
to be written to all logged-in users.
.RE
.sp
.LP
Blank lines are ignored. Lines for which the first nonwhite character is
a '\fB#\fR' are treated as comments.
.SH EXAMPLES
.LP
\fBExample 1 \fRA Sample Configuration File
.sp
.LP
With the following configuration file:

.sp

.sp
.TS
l l
l l .
\fB*.notice\fR	\fB/var/log/notice\fR
\fBmail.info\fR	\fB/var/log/notice\fR
\fB*.crit\fR	\fB/var/log/critical\fR
\fBkern,mark.debug\fR	\fB/dev/console\fR
\fBkern.err\fR	\fB@server\fR
\fB*.emerg\fR	\fB*\fR
\fB*.alert\fR	\fBroot,operator\fR
\fB*.alert;auth.warning\fR	\fB/var/log/auth\fR
.TE

.sp
.LP
\fBsyslogd\fR(1M) logs all mail system messages except \fBdebug\fR messages and
all \fBnotice\fR (or higher) messages into a file named \fB/var/log/notice\fR.
It logs all critical messages into \fB/var/log/critical\fR, and all kernel
messages and 20-minute marks onto the system console.

.sp
.LP
Kernel messages of \fBerr\fR (error) severity or higher are forwarded to the
machine named \fBserver\fR. Emergency messages are forwarded to all users. The
users \fBroot\fR and \fBoperator\fR are informed of any \fBalert\fR messages.
All messages from the authorization system of \fBwarning\fR level or higher are
logged in the file \fB/var/log/auth\fR.

.SH ATTRIBUTES
.LP
See \fBattributes\fR(5) for descriptions of the following attributes:
.sp

.sp
.TS
box;
c | c
l | l .
ATTRIBUTE TYPE	ATTRIBUTE VALUE
_
Interface Stability	Stable
.TE

.SH SEE ALSO
.LP
\fBat\fR(1), \fBcrontab\fR(1), \fBlogger\fR(1), \fBlogin\fR(1), \fBlp\fR(1),
\fBlpc\fR(1B), \fBlpr\fR(1B), \fBm4\fR(1), \fBcron\fR(1M), \fBgetty\fR(1M),
\fBin.ftpd\fR(1M), \fBsu\fR(1M), \fBsyslogd\fR(1M), \fBsyslog\fR(3C),
\fBhosts\fR(4), \fBattributes\fR(5)