xref: /freebsd/usr.sbin/syslogd/syslog.conf.5 (revision f50b861cbf094fefaf72ae42f5642015fd34a9ca)
1dea673e9SRodney W. Grimes.\" Copyright (c) 1990, 1991, 1993
2dea673e9SRodney W. Grimes.\"	The Regents of the University of California.  All rights reserved.
3dea673e9SRodney W. Grimes.\"
4dea673e9SRodney W. Grimes.\" Redistribution and use in source and binary forms, with or without
5dea673e9SRodney W. Grimes.\" modification, are permitted provided that the following conditions
6dea673e9SRodney W. Grimes.\" are met:
7dea673e9SRodney W. Grimes.\" 1. Redistributions of source code must retain the above copyright
8dea673e9SRodney W. Grimes.\"    notice, this list of conditions and the following disclaimer.
9dea673e9SRodney W. Grimes.\" 2. Redistributions in binary form must reproduce the above copyright
10dea673e9SRodney W. Grimes.\"    notice, this list of conditions and the following disclaimer in the
11dea673e9SRodney W. Grimes.\"    documentation and/or other materials provided with the distribution.
12dea673e9SRodney W. Grimes.\" 3. All advertising materials mentioning features or use of this software
13dea673e9SRodney W. Grimes.\"    must display the following acknowledgement:
14dea673e9SRodney W. Grimes.\"	This product includes software developed by the University of
15dea673e9SRodney W. Grimes.\"	California, Berkeley and its contributors.
16dea673e9SRodney W. Grimes.\" 4. Neither the name of the University nor the names of its contributors
17dea673e9SRodney W. Grimes.\"    may be used to endorse or promote products derived from this software
18dea673e9SRodney W. Grimes.\"    without specific prior written permission.
19dea673e9SRodney W. Grimes.\"
20dea673e9SRodney W. Grimes.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
21dea673e9SRodney W. Grimes.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22dea673e9SRodney W. Grimes.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23dea673e9SRodney W. Grimes.\" ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
24dea673e9SRodney W. Grimes.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25dea673e9SRodney W. Grimes.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26dea673e9SRodney W. Grimes.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27dea673e9SRodney W. Grimes.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28dea673e9SRodney W. Grimes.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29dea673e9SRodney W. Grimes.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30dea673e9SRodney W. Grimes.\" SUCH DAMAGE.
31dea673e9SRodney W. Grimes.\"
32dea673e9SRodney W. Grimes.\"     @(#)syslog.conf.5	8.1 (Berkeley) 6/9/93
3397d92980SPeter Wemm.\" $FreeBSD$
34dea673e9SRodney W. Grimes.\"
35dea673e9SRodney W. Grimes.Dd June 9, 1993
36dea673e9SRodney W. Grimes.Dt SYSLOG.CONF 5
37dea673e9SRodney W. Grimes.Os
38dea673e9SRodney W. Grimes.Sh NAME
39dea673e9SRodney W. Grimes.Nm syslog.conf
40dea673e9SRodney W. Grimes.Nd
41dea673e9SRodney W. Grimes.Xr syslogd 8
42dea673e9SRodney W. Grimesconfiguration file
43dea673e9SRodney W. Grimes.Sh DESCRIPTION
44dea673e9SRodney W. GrimesThe
4524685462SJohn-Mark Gurney.Nm
46dea673e9SRodney W. Grimesfile is the configuration file for the
47dea673e9SRodney W. Grimes.Xr syslogd 8
48dea673e9SRodney W. Grimesprogram.
49f8c034f9SJordan K. HubbardIt consists of
50f8c034f9SJordan K. Hubbardblocks of lines separated by
51f8c034f9SJordan K. Hubbard.Em program
52a144588dSDavid Maloneand
53a144588dSDavid Malone.Em hostname
54f8c034f9SJordan K. Hubbardspecifications,
55f8c034f9SJordan K. Hubbardwith each line containing two fields: the
56dea673e9SRodney W. Grimes.Em selector
57dea673e9SRodney W. Grimesfield which specifies the types of messages and priorities to which the
58dea673e9SRodney W. Grimesline applies, and an
59dea673e9SRodney W. Grimes.Em action
60dea673e9SRodney W. Grimesfield which specifies the action to be taken if a message
61922a51eeSPhilippe Charnier.Xr syslogd 8
62dea673e9SRodney W. Grimesreceives matches the selection criteria.
63dea673e9SRodney W. GrimesThe
64dea673e9SRodney W. Grimes.Em selector
65dea673e9SRodney W. Grimesfield is separated from the
66dea673e9SRodney W. Grimes.Em action
6760159a06SJordan K. Hubbardfield by one or more tab characters or spaces.
6860159a06SJordan K. Hubbard.Pp
6960159a06SJordan K. HubbardNote that if you use spaces as separators, your
707ae71655SCrist J. Clark.Nm
7160159a06SJordan K. Hubbardmight be incompatible with other Unices or Unix-like systems.
7260159a06SJordan K. HubbardThis functionality was added for the ease of configuration
7360159a06SJordan K. Hubbard(e.g. it is possible to cut-and-paste into
747ae71655SCrist J. Clark.Nm ) ,
75f2e366a1SSheldon Hearnand to avoid possible mistakes.
76f2e366a1SSheldon HearnThis change however preserves
7760159a06SJordan K. Hubbardbackwards compatibility with the old style of the
787ae71655SCrist J. Clark.Nm
7960159a06SJordan K. Hubbard(i.e. tab characters only).
80dea673e9SRodney W. Grimes.Pp
81dea673e9SRodney W. GrimesThe
827ae71655SCrist J. Clark.Em selectors
83dea673e9SRodney W. Grimesare encoded as a
84dea673e9SRodney W. Grimes.Em facility ,
8524685462SJohn-Mark Gurneya period
8624685462SJohn-Mark Gurney.Pq Dq \&. ,
872eec1ab0SPoul-Henning Kampan optional set of comparison flags
88ef21d92fSDavid Malone.Pq Bo ! Bc Bq <=> ,
8924685462SJohn-Mark Gurneyand a
90dea673e9SRodney W. Grimes.Em level ,
91dea673e9SRodney W. Grimeswith no intervening white-space.
92dea673e9SRodney W. GrimesBoth the
93dea673e9SRodney W. Grimes.Em facility
94dea673e9SRodney W. Grimesand the
95dea673e9SRodney W. Grimes.Em level
96dea673e9SRodney W. Grimesare case insensitive.
97dea673e9SRodney W. Grimes.Pp
98dea673e9SRodney W. GrimesThe
99dea673e9SRodney W. Grimes.Em facility
100dea673e9SRodney W. Grimesdescribes the part of the system generating the message, and is one of
1015c620e2dSChris Timmonsthe following keywords: auth, authpriv, console, cron, daemon, ftp, kern,
1025c620e2dSChris Timmonslpr, mail, mark, news, ntp, security, syslog, user, uucp and local0 through
10390b4a69fSRuslan Ermilovlocal7.
10490b4a69fSRuslan ErmilovThese keywords (with the exception of mark) correspond to the
105dea673e9SRodney W. Grimessimilar
106dea673e9SRodney W. Grimes.Dq Dv LOG_
107dea673e9SRodney W. Grimesvalues specified to the
108dea673e9SRodney W. Grimes.Xr openlog 3
109dea673e9SRodney W. Grimesand
110dea673e9SRodney W. Grimes.Xr syslog 3
111dea673e9SRodney W. Grimeslibrary routines.
112dea673e9SRodney W. Grimes.Pp
113dea673e9SRodney W. GrimesThe
1142eec1ab0SPoul-Henning Kamp.Em comparison flags
1152eec1ab0SPoul-Henning Kampmay be used to specify exactly what is logged.
1162eec1ab0SPoul-Henning KampThe default set of comparison flags are
1172eec1ab0SPoul-Henning Kamp.Dq =>
1182eec1ab0SPoul-Henning Kamp(or, if you prefer,
119610a5778SRuslan Ermilov.Dq >= ) ,
1202eec1ab0SPoul-Henning Kampwhich means that messages from the specified
1212eec1ab0SPoul-Henning Kamp.Em facility
1222eec1ab0SPoul-Henning Kamplist of a priority
1232eec1ab0SPoul-Henning Kamplevel equal or greater than
1242eec1ab0SPoul-Henning Kamp.Em level
1252eec1ab0SPoul-Henning Kampwill be logged.
126ef21d92fSDavid MaloneComparison flags beginning with
127ef21d92fSDavid Malone.Do ! Dc
128ef21d92fSDavid Malonewill have their logical sense inverted.
129ef21d92fSDavid MaloneThus
130ef21d92fSDavid Malone.Dq !=info
131ef21d92fSDavid Malonemeans all levels except info and
132ef21d92fSDavid Malone.Dq !notice
133ef21d92fSDavid Malonehas the same meaning as
134ef21d92fSDavid Malone.Dq <notice .
1352eec1ab0SPoul-Henning Kamp.Pp
1362eec1ab0SPoul-Henning KampThe
137dea673e9SRodney W. Grimes.Em level
138dea673e9SRodney W. Grimesdescribes the severity of the message, and is a keyword from the
139dea673e9SRodney W. Grimesfollowing ordered list (higher to lower): emerg, alert, crit, err,
1403d08ec92SPaul Trainawarning, notice, info and debug.
141dea673e9SRodney W. GrimesThese keywords correspond to the
142dea673e9SRodney W. Grimessimilar
14324685462SJohn-Mark Gurney.Dq Dv LOG_
144dea673e9SRodney W. Grimesvalues specified to the
145922a51eeSPhilippe Charnier.Xr syslog 3
146dea673e9SRodney W. Grimeslibrary routine.
147dea673e9SRodney W. Grimes.Pp
148a144588dSDavid MaloneEach block of lines is separated from the previous block by a
149a144588dSDavid Malone.Em program
150f8c034f9SJordan K. Hubbardor
151a144588dSDavid Malone.Em hostname
152a144588dSDavid Malonespecification.
153a144588dSDavid MaloneA block will only log messages corresponding to the most recent
154a144588dSDavid Malone.Em program
155a144588dSDavid Maloneand
156a144588dSDavid Malone.Em hostname
157a144588dSDavid Malonespecifications given.
158a144588dSDavid MaloneThus, a block which selects
159a144588dSDavid Malone.Ql ppp
160a144588dSDavid Maloneas the
161a144588dSDavid Malone.Em program ,
162a144588dSDavid Malonedirectly followed by a block that selects messages from the
163a144588dSDavid Malone.Em hostname
164a144588dSDavid Malone.Ql dialhost ,
165a144588dSDavid Malonethen the second block will only log messages
166a144588dSDavid Malonefrom the
167a144588dSDavid Malone.Xr ppp 8
168a144588dSDavid Maloneprogram on dialhost.
169a144588dSDavid Malone.Pp
170a144588dSDavid MaloneA
171a144588dSDavid Malone.Em program
172a144588dSDavid Malonespecification is a line beginning with
173a144588dSDavid Malone.Ql #!prog
174a144588dSDavid Maloneor
175a144588dSDavid Malone.Ql !prog
176f8c034f9SJordan K. Hubbard(the former is for compatibility with the previous syslogd, if one is sharing
1777ae71655SCrist J. Clark.Nm
178922a51eeSPhilippe Charnierfiles, for example)
179a144588dSDavid Maloneand the following blocks will be associated with calls to
180a144588dSDavid Malone.Xr syslog 3
181a144588dSDavid Malonefrom that specific program.
182a144588dSDavid MaloneA
183a144588dSDavid Malone.Em program
184a144588dSDavid Malonespecification for
185a144588dSDavid Malone.Ql foo
186a144588dSDavid Malonewill also match any message logged by the kernel with the prefix
187a144588dSDavid Malone.Ql "foo: " .
188f50b861cSDaniel C. SobralThe
189f50b861cSDaniel C. Sobral.Ql #!+prog
190f50b861cSDaniel C. Sobralor
191f50b861cSDaniel C. Sobral.Ql !+prog
192f50b861cSDaniel C. Sobralspecification works just like the previous one,
193f50b861cSDaniel C. Sobraland the
194f50b861cSDaniel C. Sobral.Ql #!-prog
195f50b861cSDaniel C. Sobralor
196f50b861cSDaniel C. Sobral.Ql !-prog
197f50b861cSDaniel C. Sobralspecification will match any message but the ones from that
198f50b861cSDaniel C. Sobralprogram.
199a144588dSDavid MaloneA
200a144588dSDavid Malone.Em hostname
201a144588dSDavid Malonespecification of the form
202a144588dSDavid Malone.Ql #+hostname
203a144588dSDavid Maloneor
204a144588dSDavid Malone.Ql +hostname
205a144588dSDavid Maloneand the following blocks will be applied to messages
206a144588dSDavid Malonereceived from the specified hostname.
207a144588dSDavid MaloneAlternatively, a
208a144588dSDavid Malone.Em hostname
209a144588dSDavid Malonespecification
210a144588dSDavid Malone.Ql #-hostname
211a144588dSDavid Maloneor
212a144588dSDavid Malone.Ql -hostname
213a144588dSDavid Malonecauses the following blocks to be applied to messages
214a144588dSDavid Malonefrom any host but the one specified.
215a144588dSDavid MaloneIf the hostname is given as
216a144588dSDavid Malone.Ql @ ,
217a144588dSDavid Malonethe local hostname will be used.
218a144588dSDavid MaloneA
219a144588dSDavid Malone.Em program
220a144588dSDavid Maloneor
221a144588dSDavid Malone.Em hostname
222a144588dSDavid Malonespecification may be reset by giving the program or hostname as
223a144588dSDavid Malone.Ql * .
224f8c034f9SJordan K. Hubbard.Pp
225dea673e9SRodney W. GrimesSee
226dea673e9SRodney W. Grimes.Xr syslog 3
227dea673e9SRodney W. Grimesfor a further descriptions of both the
228dea673e9SRodney W. Grimes.Em facility
229dea673e9SRodney W. Grimesand
230dea673e9SRodney W. Grimes.Em level
231f2e366a1SSheldon Hearnkeywords and their significance.
232f2e366a1SSheldon HearnIt's preferred that selections be made on
233f8c034f9SJordan K. Hubbard.Em facility
234f8c034f9SJordan K. Hubbardrather than
235f8c034f9SJordan K. Hubbard.Em program ,
236f2e366a1SSheldon Hearnsince the latter can easily vary in a networked environment.
237f2e366a1SSheldon HearnIn some cases,
238f8c034f9SJordan K. Hubbardthough, an appropriate
239f8c034f9SJordan K. Hubbard.Em facility
24024685462SJohn-Mark Gurneysimply doesn't exist.
241dea673e9SRodney W. Grimes.Pp
242dea673e9SRodney W. GrimesIf a received message matches the specified
243dea673e9SRodney W. Grimes.Em facility
244dea673e9SRodney W. Grimesand is of the specified
245dea673e9SRodney W. Grimes.Em level
246dea673e9SRodney W. Grimes.Em (or a higher level) ,
247f8c034f9SJordan K. Hubbardand the first word in the message after the date matches the
248f8c034f9SJordan K. Hubbard.Em program ,
249dea673e9SRodney W. Grimesthe action specified in the
250dea673e9SRodney W. Grimes.Em action
251dea673e9SRodney W. Grimesfield will be taken.
252dea673e9SRodney W. Grimes.Pp
253dea673e9SRodney W. GrimesMultiple
254dea673e9SRodney W. Grimes.Em selectors
255dea673e9SRodney W. Grimesmay be specified for a single
256dea673e9SRodney W. Grimes.Em action
25724685462SJohn-Mark Gurneyby separating them with semicolon
25824685462SJohn-Mark Gurney.Pq Dq \&;
25924685462SJohn-Mark Gurneycharacters.
260dea673e9SRodney W. GrimesIt is important to note, however, that each
261dea673e9SRodney W. Grimes.Em selector
262dea673e9SRodney W. Grimescan modify the ones preceding it.
263dea673e9SRodney W. Grimes.Pp
264dea673e9SRodney W. GrimesMultiple
265dea673e9SRodney W. Grimes.Em facilities
266dea673e9SRodney W. Grimesmay be specified for a single
267dea673e9SRodney W. Grimes.Em level
26824685462SJohn-Mark Gurneyby separating them with comma
26924685462SJohn-Mark Gurney.Pq Dq \&,
27024685462SJohn-Mark Gurneycharacters.
271dea673e9SRodney W. Grimes.Pp
27224685462SJohn-Mark GurneyAn asterisk
27324685462SJohn-Mark Gurney.Pq Dq *
27424685462SJohn-Mark Gurneycan be used to specify all
275dea673e9SRodney W. Grimes.Em facilities
276f8c034f9SJordan K. Hubbardall
277f8c034f9SJordan K. Hubbard.Em levels
278dea673e9SRodney W. Grimesor all
279f8c034f9SJordan K. Hubbard.Em programs .
280dea673e9SRodney W. Grimes.Pp
281dea673e9SRodney W. GrimesThe special
282dea673e9SRodney W. Grimes.Em facility
28324685462SJohn-Mark Gurney.Dq mark
28424685462SJohn-Mark Gurneyreceives a message at priority
28524685462SJohn-Mark Gurney.Dq info
28624685462SJohn-Mark Gurneyevery 20 minutes
287dea673e9SRodney W. Grimes(see
288dea673e9SRodney W. Grimes.Xr syslogd 8 ) .
289dea673e9SRodney W. GrimesThis is not enabled by a
290dea673e9SRodney W. Grimes.Em facility
291dea673e9SRodney W. Grimesfield containing an asterisk.
292dea673e9SRodney W. Grimes.Pp
293dea673e9SRodney W. GrimesThe special
294dea673e9SRodney W. Grimes.Em level
29524685462SJohn-Mark Gurney.Dq none
29624685462SJohn-Mark Gurneydisables a particular
297dea673e9SRodney W. Grimes.Em facility .
298dea673e9SRodney W. Grimes.Pp
299dea673e9SRodney W. GrimesThe
300dea673e9SRodney W. Grimes.Em action
301dea673e9SRodney W. Grimesfield of each line specifies the action to be taken when the
302dea673e9SRodney W. Grimes.Em selector
303dea673e9SRodney W. Grimesfield selects a message.
3045fadfc4cSJoerg WunschThere are five forms:
305dea673e9SRodney W. Grimes.Bl -bullet
306dea673e9SRodney W. Grimes.It
307dea673e9SRodney W. GrimesA pathname (beginning with a leading slash).
308dea673e9SRodney W. GrimesSelected messages are appended to the file.
309dea673e9SRodney W. Grimes.It
31024685462SJohn-Mark GurneyA hostname (preceded by an at
31124685462SJohn-Mark Gurney.Pq Dq @
31224685462SJohn-Mark Gurneysign).
313dea673e9SRodney W. GrimesSelected messages are forwarded to the
314922a51eeSPhilippe Charnier.Xr syslogd 8
315dea673e9SRodney W. Grimesprogram on the named host.
316dea673e9SRodney W. Grimes.It
317dea673e9SRodney W. GrimesA comma separated list of users.
318dea673e9SRodney W. GrimesSelected messages are written to those users
319dea673e9SRodney W. Grimesif they are logged in.
320dea673e9SRodney W. Grimes.It
321dea673e9SRodney W. GrimesAn asterisk.
322dea673e9SRodney W. GrimesSelected messages are written to all logged-in users.
3235fadfc4cSJoerg Wunsch.It
32424685462SJohn-Mark GurneyA vertical bar
32524685462SJohn-Mark Gurney.Pq Dq \&| ,
32624685462SJohn-Mark Gurneyfollowed by a command to pipe the selected
3277ae71655SCrist J. Clarkmessages to.  The command is passed to
3287ae71655SCrist J. Clark.Xr sh 1
3295fadfc4cSJoerg Wunschfor evaluation, so usual shell metacharacters or input/output
3305fadfc4cSJoerg Wunschredirection can occur.  (Note however that redirecting
3315fadfc4cSJoerg Wunsch.Xr stdio 3
3325fadfc4cSJoerg Wunschbuffered output from the invoked command can cause additional delays,
3335fadfc4cSJoerg Wunschor even lost output data in case a logging subprocess exited with a
3345fadfc4cSJoerg Wunschsignal.)  The command itself runs with
3355fadfc4cSJoerg Wunsch.Em stdout
3365fadfc4cSJoerg Wunschand
3375fadfc4cSJoerg Wunsch.Em stderr
3385fadfc4cSJoerg Wunschredirected to
3395fadfc4cSJoerg Wunsch.Pa /dev/null .
3405fadfc4cSJoerg WunschUpon receipt of a
3415fadfc4cSJoerg Wunsch.Dv SIGHUP ,
3427ae71655SCrist J. Clark.Xr syslogd 8
3435fadfc4cSJoerg Wunschwill close the pipe to the process.  If the process didn't exit
3447fa793ccSMike Pritchardvoluntarily, it will be sent a
3455fadfc4cSJoerg Wunsch.Dv SIGTERM
34681be6c75SJoerg Wunschsignal after a grace period of up to 60 seconds.
3475fadfc4cSJoerg Wunsch.Pp
3487fa793ccSMike PritchardThe command will only be started once data arrives that should be piped
34981be6c75SJoerg Wunschto it.  If it exited later, it will be restarted as necessary.  So if it
35081be6c75SJoerg Wunschis desired that the subprocess should get exactly one line of input only
35181be6c75SJoerg Wunsch(which can be very resource-consuming if there are a lot of messages
35281be6c75SJoerg Wunschflowing quickly), this can be achieved by exiting after just one line of
35381be6c75SJoerg Wunschinput.  If necessary, a script wrapper can be written to this effect.
3545fadfc4cSJoerg Wunsch.Pp
3555fadfc4cSJoerg WunschUnless the command is a full pipeline, it's probably useful to
3565fadfc4cSJoerg Wunschstart the command with
3575fadfc4cSJoerg Wunsch.Em exec
3585fadfc4cSJoerg Wunschso that the invoking shell process does not wait for the command to
3597fa793ccSMike Pritchardcomplete.  Warning: the process is started under the UID invoking
3605fadfc4cSJoerg Wunsch.Xr syslogd 8 ,
3617fa793ccSMike Pritchardnormally the superuser.
362dea673e9SRodney W. Grimes.El
363dea673e9SRodney W. Grimes.Pp
36424685462SJohn-Mark GurneyBlank lines and lines whose first non-blank character is a hash
36524685462SJohn-Mark Gurney.Pq Dq #
366dea673e9SRodney W. Grimescharacter are ignored.
367dea673e9SRodney W. Grimes.Sh EXAMPLES
368dea673e9SRodney W. GrimesA configuration file might appear as follows:
369dea673e9SRodney W. Grimes.Bd -literal
370dea673e9SRodney W. Grimes# Log all kernel messages, authentication messages of
371dea673e9SRodney W. Grimes# level notice or higher and anything of level err or
372dea673e9SRodney W. Grimes# higher to the console.
373dea673e9SRodney W. Grimes# Don't log private authentication messages!
374dea673e9SRodney W. Grimes*.err;kern.*;auth.notice;authpriv.none	/dev/console
375dea673e9SRodney W. Grimes
376dea673e9SRodney W. Grimes# Log anything (except mail) of level info or higher.
377dea673e9SRodney W. Grimes# Don't log private authentication messages!
378dea673e9SRodney W. Grimes*.info;mail.none;authpriv.none		/var/log/messages
379dea673e9SRodney W. Grimes
3802eec1ab0SPoul-Henning Kamp# Log daemon messages at debug level only
3812eec1ab0SPoul-Henning Kampdaemon.=debug						/var/log/daemon.debug
3822eec1ab0SPoul-Henning Kamp
383dea673e9SRodney W. Grimes# The authpriv file has restricted access.
384dea673e9SRodney W. Grimesauthpriv.*						/var/log/secure
385dea673e9SRodney W. Grimes
386dea673e9SRodney W. Grimes# Log all the mail messages in one place.
387dea673e9SRodney W. Grimesmail.*							/var/log/maillog
388dea673e9SRodney W. Grimes
389dea673e9SRodney W. Grimes# Everybody gets emergency messages, plus log them on another
390dea673e9SRodney W. Grimes# machine.
391dea673e9SRodney W. Grimes*.emerg							*
392dea673e9SRodney W. Grimes*.emerg							@arpa.berkeley.edu
393dea673e9SRodney W. Grimes
394dea673e9SRodney W. Grimes# Root and Eric get alert and higher messages.
395dea673e9SRodney W. Grimes*.alert							root,eric
396dea673e9SRodney W. Grimes
397dea673e9SRodney W. Grimes# Save mail and news errors of level err and higher in a
398dea673e9SRodney W. Grimes# special file.
399dea673e9SRodney W. Grimesuucp,news.crit						/var/log/spoolerr
400f8c034f9SJordan K. Hubbard
4015fadfc4cSJoerg Wunsch# Pipe all authentication messages to a filter.
4025fadfc4cSJoerg Wunschauth.*					|exec /usr/local/sbin/authfilter
4035fadfc4cSJoerg Wunsch
404f8c034f9SJordan K. Hubbard# Save ftpd transactions along with mail and news
405f8c034f9SJordan K. Hubbard!ftpd
406f8c034f9SJordan K. Hubbard*.*							/var/log/spoolerr
407d2b4b1faSJulian Elischer
408fa62586aSBrian Feldman# Log all security messages to a separate file.
409fa62586aSBrian Feldmansecurity.*						/var/log/security
4105c620e2dSChris Timmons
4115c620e2dSChris Timmons# Log all writes to /dev/console to a separate file.
4125c620e2dSChris Timmonsconsole.*						/var/log/console.log
413dea673e9SRodney W. Grimes.Ed
414481a1902SDavid Malone.Sh IMPLEMENTATION NOTES
415481a1902SDavid MaloneThe
416481a1902SDavid Malone.Dq kern
417481a1902SDavid Malonefacility is usually reserved for messages
418481a1902SDavid Malonegenerated by the local kernel.
419481a1902SDavid MaloneOther messages logged with facility
420481a1902SDavid Malone.Dq kern
421481a1902SDavid Maloneare usually translated to facility
422481a1902SDavid Malone.Dq user .
423481a1902SDavid MaloneThis translation can be disabled,
424481a1902SDavid Malonesee
425481a1902SDavid Malone.Xr syslogd 8
426481a1902SDavid Malonefor details.
427dea673e9SRodney W. Grimes.Sh FILES
428dea673e9SRodney W. Grimes.Bl -tag -width /etc/syslog.conf -compact
429dea673e9SRodney W. Grimes.It Pa /etc/syslog.conf
430dea673e9SRodney W. Grimes.Xr syslogd 8
431b8b7e105SPhilippe Charnierconfiguration file
432dea673e9SRodney W. Grimes.El
433dea673e9SRodney W. Grimes.Sh BUGS
434922a51eeSPhilippe CharnierThe effects of multiple
435922a51eeSPhilippe Charnier.Em selectors
436922a51eeSPhilippe Charnierare sometimes not intuitive.
43724685462SJohn-Mark GurneyFor example
43824685462SJohn-Mark Gurney.Dq mail.crit,*.err
43924685462SJohn-Mark Gurneywill select
44024685462SJohn-Mark Gurney.Dq mail
44124685462SJohn-Mark Gurneyfacility messages at the level of
44224685462SJohn-Mark Gurney.Dq err
44324685462SJohn-Mark Gurneyor higher, not at the level of
44424685462SJohn-Mark Gurney.Dq crit
44524685462SJohn-Mark Gurneyor higher.
446605efc87SJoerg Wunsch.Pp
447605efc87SJoerg WunschIn networked environments, note that not all operating systems
448605efc87SJoerg Wunschimplement the same set of facilities.  The facilities
449605efc87SJoerg Wunschauthpriv, cron, ftp, and ntp that are known to this implementation
450605efc87SJoerg Wunschmight be absent on the target system.  Even worse, DEC UNIX uses
451605efc87SJoerg Wunschfacility number 10 (which is authpriv in this implementation) to
452605efc87SJoerg Wunschlog events for their AdvFS filesystem.
453dea673e9SRodney W. Grimes.Sh SEE ALSO
454dea673e9SRodney W. Grimes.Xr syslog 3 ,
455dea673e9SRodney W. Grimes.Xr syslogd 8
456