1dea673e9SRodney W. Grimes.\" Copyright (c) 1990, 1991, 1993 2dea673e9SRodney W. Grimes.\" The Regents of the University of California. All rights reserved. 3dea673e9SRodney W. Grimes.\" 4dea673e9SRodney W. Grimes.\" Redistribution and use in source and binary forms, with or without 5dea673e9SRodney W. Grimes.\" modification, are permitted provided that the following conditions 6dea673e9SRodney W. Grimes.\" are met: 7dea673e9SRodney W. Grimes.\" 1. Redistributions of source code must retain the above copyright 8dea673e9SRodney W. Grimes.\" notice, this list of conditions and the following disclaimer. 9dea673e9SRodney W. Grimes.\" 2. Redistributions in binary form must reproduce the above copyright 10dea673e9SRodney W. Grimes.\" notice, this list of conditions and the following disclaimer in the 11dea673e9SRodney W. Grimes.\" documentation and/or other materials provided with the distribution. 12dea673e9SRodney W. Grimes.\" 3. All advertising materials mentioning features or use of this software 13dea673e9SRodney W. Grimes.\" must display the following acknowledgement: 14dea673e9SRodney W. Grimes.\" This product includes software developed by the University of 15dea673e9SRodney W. Grimes.\" California, Berkeley and its contributors. 16dea673e9SRodney W. Grimes.\" 4. Neither the name of the University nor the names of its contributors 17dea673e9SRodney W. Grimes.\" may be used to endorse or promote products derived from this software 18dea673e9SRodney W. Grimes.\" without specific prior written permission. 19dea673e9SRodney W. Grimes.\" 20dea673e9SRodney W. Grimes.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 21dea673e9SRodney W. Grimes.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22dea673e9SRodney W. Grimes.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23dea673e9SRodney W. Grimes.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 24dea673e9SRodney W. Grimes.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 25dea673e9SRodney W. Grimes.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 26dea673e9SRodney W. Grimes.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 27dea673e9SRodney W. Grimes.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28dea673e9SRodney W. Grimes.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 29dea673e9SRodney W. Grimes.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 30dea673e9SRodney W. Grimes.\" SUCH DAMAGE. 31dea673e9SRodney W. Grimes.\" 32dea673e9SRodney W. Grimes.\" @(#)syslog.conf.5 8.1 (Berkeley) 6/9/93 3397d92980SPeter Wemm.\" $FreeBSD$ 34dea673e9SRodney W. Grimes.\" 35dea673e9SRodney W. Grimes.Dd June 9, 1993 36dea673e9SRodney W. Grimes.Dt SYSLOG.CONF 5 37dea673e9SRodney W. Grimes.Os 38dea673e9SRodney W. Grimes.Sh NAME 39dea673e9SRodney W. Grimes.Nm syslog.conf 40dea673e9SRodney W. Grimes.Nd 41dea673e9SRodney W. Grimes.Xr syslogd 8 42dea673e9SRodney W. Grimesconfiguration file 43dea673e9SRodney W. Grimes.Sh DESCRIPTION 44dea673e9SRodney W. GrimesThe 4524685462SJohn-Mark Gurney.Nm 46dea673e9SRodney W. Grimesfile is the configuration file for the 47dea673e9SRodney W. Grimes.Xr syslogd 8 48dea673e9SRodney W. Grimesprogram. 49f8c034f9SJordan K. HubbardIt consists of 50f8c034f9SJordan K. Hubbardblocks of lines separated by 51f8c034f9SJordan K. Hubbard.Em program 52a144588dSDavid Maloneand 53a144588dSDavid Malone.Em hostname 54f8c034f9SJordan K. Hubbardspecifications, 55f8c034f9SJordan K. Hubbardwith each line containing two fields: the 56dea673e9SRodney W. Grimes.Em selector 57dea673e9SRodney W. Grimesfield which specifies the types of messages and priorities to which the 58dea673e9SRodney W. Grimesline applies, and an 59dea673e9SRodney W. Grimes.Em action 60dea673e9SRodney W. Grimesfield which specifies the action to be taken if a message 61922a51eeSPhilippe Charnier.Xr syslogd 8 62dea673e9SRodney W. Grimesreceives matches the selection criteria. 63dea673e9SRodney W. GrimesThe 64dea673e9SRodney W. Grimes.Em selector 65dea673e9SRodney W. Grimesfield is separated from the 66dea673e9SRodney W. Grimes.Em action 6760159a06SJordan K. Hubbardfield by one or more tab characters or spaces. 6860159a06SJordan K. Hubbard.Pp 6960159a06SJordan K. HubbardNote that if you use spaces as separators, your 707ae71655SCrist J. Clark.Nm 7160159a06SJordan K. Hubbardmight be incompatible with other Unices or Unix-like systems. 7260159a06SJordan K. HubbardThis functionality was added for the ease of configuration 7360159a06SJordan K. Hubbard(e.g. it is possible to cut-and-paste into 747ae71655SCrist J. Clark.Nm ) , 75f2e366a1SSheldon Hearnand to avoid possible mistakes. 76f2e366a1SSheldon HearnThis change however preserves 7760159a06SJordan K. Hubbardbackwards compatibility with the old style of the 787ae71655SCrist J. Clark.Nm 7960159a06SJordan K. Hubbard(i.e. tab characters only). 80dea673e9SRodney W. Grimes.Pp 81dea673e9SRodney W. GrimesThe 827ae71655SCrist J. Clark.Em selectors 83dea673e9SRodney W. Grimesare encoded as a 84dea673e9SRodney W. Grimes.Em facility , 8524685462SJohn-Mark Gurneya period 8624685462SJohn-Mark Gurney.Pq Dq \&. , 872eec1ab0SPoul-Henning Kampan optional set of comparison flags 88ef21d92fSDavid Malone.Pq Bo ! Bc Bq <=> , 8924685462SJohn-Mark Gurneyand a 90dea673e9SRodney W. Grimes.Em level , 91dea673e9SRodney W. Grimeswith no intervening white-space. 92dea673e9SRodney W. GrimesBoth the 93dea673e9SRodney W. Grimes.Em facility 94dea673e9SRodney W. Grimesand the 95dea673e9SRodney W. Grimes.Em level 96dea673e9SRodney W. Grimesare case insensitive. 97dea673e9SRodney W. Grimes.Pp 98dea673e9SRodney W. GrimesThe 99dea673e9SRodney W. Grimes.Em facility 100dea673e9SRodney W. Grimesdescribes the part of the system generating the message, and is one of 1015c620e2dSChris Timmonsthe following keywords: auth, authpriv, console, cron, daemon, ftp, kern, 1025c620e2dSChris Timmonslpr, mail, mark, news, ntp, security, syslog, user, uucp and local0 through 10390b4a69fSRuslan Ermilovlocal7. 10490b4a69fSRuslan ErmilovThese keywords (with the exception of mark) correspond to the 105dea673e9SRodney W. Grimessimilar 106dea673e9SRodney W. Grimes.Dq Dv LOG_ 107dea673e9SRodney W. Grimesvalues specified to the 108dea673e9SRodney W. Grimes.Xr openlog 3 109dea673e9SRodney W. Grimesand 110dea673e9SRodney W. Grimes.Xr syslog 3 111dea673e9SRodney W. Grimeslibrary routines. 112dea673e9SRodney W. Grimes.Pp 113dea673e9SRodney W. GrimesThe 1142eec1ab0SPoul-Henning Kamp.Em comparison flags 1152eec1ab0SPoul-Henning Kampmay be used to specify exactly what is logged. 1162eec1ab0SPoul-Henning KampThe default set of comparison flags are 1172eec1ab0SPoul-Henning Kamp.Dq => 1182eec1ab0SPoul-Henning Kamp(or, if you prefer, 119610a5778SRuslan Ermilov.Dq >= ) , 1202eec1ab0SPoul-Henning Kampwhich means that messages from the specified 1212eec1ab0SPoul-Henning Kamp.Em facility 1222eec1ab0SPoul-Henning Kamplist of a priority 1232eec1ab0SPoul-Henning Kamplevel equal or greater than 1242eec1ab0SPoul-Henning Kamp.Em level 1252eec1ab0SPoul-Henning Kampwill be logged. 126ef21d92fSDavid MaloneComparison flags beginning with 127ef21d92fSDavid Malone.Do ! Dc 128ef21d92fSDavid Malonewill have their logical sense inverted. 129ef21d92fSDavid MaloneThus 130ef21d92fSDavid Malone.Dq !=info 131ef21d92fSDavid Malonemeans all levels except info and 132ef21d92fSDavid Malone.Dq !notice 133ef21d92fSDavid Malonehas the same meaning as 134ef21d92fSDavid Malone.Dq <notice . 1352eec1ab0SPoul-Henning Kamp.Pp 1362eec1ab0SPoul-Henning KampThe 137dea673e9SRodney W. Grimes.Em level 138dea673e9SRodney W. Grimesdescribes the severity of the message, and is a keyword from the 139dea673e9SRodney W. Grimesfollowing ordered list (higher to lower): emerg, alert, crit, err, 1403d08ec92SPaul Trainawarning, notice, info and debug. 141dea673e9SRodney W. GrimesThese keywords correspond to the 142dea673e9SRodney W. Grimessimilar 14324685462SJohn-Mark Gurney.Dq Dv LOG_ 144dea673e9SRodney W. Grimesvalues specified to the 145922a51eeSPhilippe Charnier.Xr syslog 3 146dea673e9SRodney W. Grimeslibrary routine. 147dea673e9SRodney W. Grimes.Pp 148a144588dSDavid MaloneEach block of lines is separated from the previous block by a 149a144588dSDavid Malone.Em program 150f8c034f9SJordan K. Hubbardor 151a144588dSDavid Malone.Em hostname 152a144588dSDavid Malonespecification. 153a144588dSDavid MaloneA block will only log messages corresponding to the most recent 154a144588dSDavid Malone.Em program 155a144588dSDavid Maloneand 156a144588dSDavid Malone.Em hostname 157a144588dSDavid Malonespecifications given. 158a144588dSDavid MaloneThus, a block which selects 159a144588dSDavid Malone.Ql ppp 160a144588dSDavid Maloneas the 161a144588dSDavid Malone.Em program , 162a144588dSDavid Malonedirectly followed by a block that selects messages from the 163a144588dSDavid Malone.Em hostname 164a144588dSDavid Malone.Ql dialhost , 165a144588dSDavid Malonethen the second block will only log messages 166a144588dSDavid Malonefrom the 167a144588dSDavid Malone.Xr ppp 8 168a144588dSDavid Maloneprogram on dialhost. 169a144588dSDavid Malone.Pp 170a144588dSDavid MaloneA 171a144588dSDavid Malone.Em program 172a144588dSDavid Malonespecification is a line beginning with 173a144588dSDavid Malone.Ql #!prog 174a144588dSDavid Maloneor 175a144588dSDavid Malone.Ql !prog 176f8c034f9SJordan K. Hubbard(the former is for compatibility with the previous syslogd, if one is sharing 1777ae71655SCrist J. Clark.Nm 178922a51eeSPhilippe Charnierfiles, for example) 179a144588dSDavid Maloneand the following blocks will be associated with calls to 180a144588dSDavid Malone.Xr syslog 3 181a144588dSDavid Malonefrom that specific program. 182a144588dSDavid MaloneA 183a144588dSDavid Malone.Em program 184a144588dSDavid Malonespecification for 185a144588dSDavid Malone.Ql foo 186a144588dSDavid Malonewill also match any message logged by the kernel with the prefix 187a144588dSDavid Malone.Ql "foo: " . 188f50b861cSDaniel C. SobralThe 189f50b861cSDaniel C. Sobral.Ql #!+prog 190f50b861cSDaniel C. Sobralor 191f50b861cSDaniel C. Sobral.Ql !+prog 192f50b861cSDaniel C. Sobralspecification works just like the previous one, 193f50b861cSDaniel C. Sobraland the 194f50b861cSDaniel C. Sobral.Ql #!-prog 195f50b861cSDaniel C. Sobralor 196f50b861cSDaniel C. Sobral.Ql !-prog 197f50b861cSDaniel C. Sobralspecification will match any message but the ones from that 198f50b861cSDaniel C. Sobralprogram. 199a144588dSDavid MaloneA 200a144588dSDavid Malone.Em hostname 201a144588dSDavid Malonespecification of the form 202a144588dSDavid Malone.Ql #+hostname 203a144588dSDavid Maloneor 204a144588dSDavid Malone.Ql +hostname 205a144588dSDavid Maloneand the following blocks will be applied to messages 206a144588dSDavid Malonereceived from the specified hostname. 207a144588dSDavid MaloneAlternatively, a 208a144588dSDavid Malone.Em hostname 209a144588dSDavid Malonespecification 210a144588dSDavid Malone.Ql #-hostname 211a144588dSDavid Maloneor 212a144588dSDavid Malone.Ql -hostname 213a144588dSDavid Malonecauses the following blocks to be applied to messages 214a144588dSDavid Malonefrom any host but the one specified. 215a144588dSDavid MaloneIf the hostname is given as 216a144588dSDavid Malone.Ql @ , 217a144588dSDavid Malonethe local hostname will be used. 218a144588dSDavid MaloneA 219a144588dSDavid Malone.Em program 220a144588dSDavid Maloneor 221a144588dSDavid Malone.Em hostname 222a144588dSDavid Malonespecification may be reset by giving the program or hostname as 223a144588dSDavid Malone.Ql * . 224f8c034f9SJordan K. Hubbard.Pp 225dea673e9SRodney W. GrimesSee 226dea673e9SRodney W. Grimes.Xr syslog 3 227dea673e9SRodney W. Grimesfor a further descriptions of both the 228dea673e9SRodney W. Grimes.Em facility 229dea673e9SRodney W. Grimesand 230dea673e9SRodney W. Grimes.Em level 231f2e366a1SSheldon Hearnkeywords and their significance. 232f2e366a1SSheldon HearnIt's preferred that selections be made on 233f8c034f9SJordan K. Hubbard.Em facility 234f8c034f9SJordan K. Hubbardrather than 235f8c034f9SJordan K. Hubbard.Em program , 236f2e366a1SSheldon Hearnsince the latter can easily vary in a networked environment. 237f2e366a1SSheldon HearnIn some cases, 238f8c034f9SJordan K. Hubbardthough, an appropriate 239f8c034f9SJordan K. Hubbard.Em facility 24024685462SJohn-Mark Gurneysimply doesn't exist. 241dea673e9SRodney W. Grimes.Pp 242dea673e9SRodney W. GrimesIf a received message matches the specified 243dea673e9SRodney W. Grimes.Em facility 244dea673e9SRodney W. Grimesand is of the specified 245dea673e9SRodney W. Grimes.Em level 246dea673e9SRodney W. Grimes.Em (or a higher level) , 247f8c034f9SJordan K. Hubbardand the first word in the message after the date matches the 248f8c034f9SJordan K. Hubbard.Em program , 249dea673e9SRodney W. Grimesthe action specified in the 250dea673e9SRodney W. Grimes.Em action 251dea673e9SRodney W. Grimesfield will be taken. 252dea673e9SRodney W. Grimes.Pp 253dea673e9SRodney W. GrimesMultiple 254dea673e9SRodney W. Grimes.Em selectors 255dea673e9SRodney W. Grimesmay be specified for a single 256dea673e9SRodney W. Grimes.Em action 25724685462SJohn-Mark Gurneyby separating them with semicolon 25824685462SJohn-Mark Gurney.Pq Dq \&; 25924685462SJohn-Mark Gurneycharacters. 260dea673e9SRodney W. GrimesIt is important to note, however, that each 261dea673e9SRodney W. Grimes.Em selector 262dea673e9SRodney W. Grimescan modify the ones preceding it. 263dea673e9SRodney W. Grimes.Pp 264dea673e9SRodney W. GrimesMultiple 265dea673e9SRodney W. Grimes.Em facilities 266dea673e9SRodney W. Grimesmay be specified for a single 267dea673e9SRodney W. Grimes.Em level 26824685462SJohn-Mark Gurneyby separating them with comma 26924685462SJohn-Mark Gurney.Pq Dq \&, 27024685462SJohn-Mark Gurneycharacters. 271dea673e9SRodney W. Grimes.Pp 27224685462SJohn-Mark GurneyAn asterisk 27324685462SJohn-Mark Gurney.Pq Dq * 27424685462SJohn-Mark Gurneycan be used to specify all 275dea673e9SRodney W. Grimes.Em facilities 276f8c034f9SJordan K. Hubbardall 277f8c034f9SJordan K. Hubbard.Em levels 278dea673e9SRodney W. Grimesor all 279f8c034f9SJordan K. Hubbard.Em programs . 280dea673e9SRodney W. Grimes.Pp 281dea673e9SRodney W. GrimesThe special 282dea673e9SRodney W. Grimes.Em facility 28324685462SJohn-Mark Gurney.Dq mark 28424685462SJohn-Mark Gurneyreceives a message at priority 28524685462SJohn-Mark Gurney.Dq info 28624685462SJohn-Mark Gurneyevery 20 minutes 287dea673e9SRodney W. Grimes(see 288dea673e9SRodney W. Grimes.Xr syslogd 8 ) . 289dea673e9SRodney W. GrimesThis is not enabled by a 290dea673e9SRodney W. Grimes.Em facility 291dea673e9SRodney W. Grimesfield containing an asterisk. 292dea673e9SRodney W. Grimes.Pp 293dea673e9SRodney W. GrimesThe special 294dea673e9SRodney W. Grimes.Em level 29524685462SJohn-Mark Gurney.Dq none 29624685462SJohn-Mark Gurneydisables a particular 297dea673e9SRodney W. Grimes.Em facility . 298dea673e9SRodney W. Grimes.Pp 299dea673e9SRodney W. GrimesThe 300dea673e9SRodney W. Grimes.Em action 301dea673e9SRodney W. Grimesfield of each line specifies the action to be taken when the 302dea673e9SRodney W. Grimes.Em selector 303dea673e9SRodney W. Grimesfield selects a message. 3045fadfc4cSJoerg WunschThere are five forms: 305dea673e9SRodney W. Grimes.Bl -bullet 306dea673e9SRodney W. Grimes.It 307dea673e9SRodney W. GrimesA pathname (beginning with a leading slash). 308dea673e9SRodney W. GrimesSelected messages are appended to the file. 309dea673e9SRodney W. Grimes.It 31024685462SJohn-Mark GurneyA hostname (preceded by an at 31124685462SJohn-Mark Gurney.Pq Dq @ 31224685462SJohn-Mark Gurneysign). 313dea673e9SRodney W. GrimesSelected messages are forwarded to the 314922a51eeSPhilippe Charnier.Xr syslogd 8 315dea673e9SRodney W. Grimesprogram on the named host. 316dea673e9SRodney W. Grimes.It 317dea673e9SRodney W. GrimesA comma separated list of users. 318dea673e9SRodney W. GrimesSelected messages are written to those users 319dea673e9SRodney W. Grimesif they are logged in. 320dea673e9SRodney W. Grimes.It 321dea673e9SRodney W. GrimesAn asterisk. 322dea673e9SRodney W. GrimesSelected messages are written to all logged-in users. 3235fadfc4cSJoerg Wunsch.It 32424685462SJohn-Mark GurneyA vertical bar 32524685462SJohn-Mark Gurney.Pq Dq \&| , 32624685462SJohn-Mark Gurneyfollowed by a command to pipe the selected 3277ae71655SCrist J. Clarkmessages to. The command is passed to 3287ae71655SCrist J. Clark.Xr sh 1 3295fadfc4cSJoerg Wunschfor evaluation, so usual shell metacharacters or input/output 3305fadfc4cSJoerg Wunschredirection can occur. (Note however that redirecting 3315fadfc4cSJoerg Wunsch.Xr stdio 3 3325fadfc4cSJoerg Wunschbuffered output from the invoked command can cause additional delays, 3335fadfc4cSJoerg Wunschor even lost output data in case a logging subprocess exited with a 3345fadfc4cSJoerg Wunschsignal.) The command itself runs with 3355fadfc4cSJoerg Wunsch.Em stdout 3365fadfc4cSJoerg Wunschand 3375fadfc4cSJoerg Wunsch.Em stderr 3385fadfc4cSJoerg Wunschredirected to 3395fadfc4cSJoerg Wunsch.Pa /dev/null . 3405fadfc4cSJoerg WunschUpon receipt of a 3415fadfc4cSJoerg Wunsch.Dv SIGHUP , 3427ae71655SCrist J. Clark.Xr syslogd 8 3435fadfc4cSJoerg Wunschwill close the pipe to the process. If the process didn't exit 3447fa793ccSMike Pritchardvoluntarily, it will be sent a 3455fadfc4cSJoerg Wunsch.Dv SIGTERM 34681be6c75SJoerg Wunschsignal after a grace period of up to 60 seconds. 3475fadfc4cSJoerg Wunsch.Pp 3487fa793ccSMike PritchardThe command will only be started once data arrives that should be piped 34981be6c75SJoerg Wunschto it. If it exited later, it will be restarted as necessary. So if it 35081be6c75SJoerg Wunschis desired that the subprocess should get exactly one line of input only 35181be6c75SJoerg Wunsch(which can be very resource-consuming if there are a lot of messages 35281be6c75SJoerg Wunschflowing quickly), this can be achieved by exiting after just one line of 35381be6c75SJoerg Wunschinput. If necessary, a script wrapper can be written to this effect. 3545fadfc4cSJoerg Wunsch.Pp 3555fadfc4cSJoerg WunschUnless the command is a full pipeline, it's probably useful to 3565fadfc4cSJoerg Wunschstart the command with 3575fadfc4cSJoerg Wunsch.Em exec 3585fadfc4cSJoerg Wunschso that the invoking shell process does not wait for the command to 3597fa793ccSMike Pritchardcomplete. Warning: the process is started under the UID invoking 3605fadfc4cSJoerg Wunsch.Xr syslogd 8 , 3617fa793ccSMike Pritchardnormally the superuser. 362dea673e9SRodney W. Grimes.El 363dea673e9SRodney W. Grimes.Pp 36424685462SJohn-Mark GurneyBlank lines and lines whose first non-blank character is a hash 36524685462SJohn-Mark Gurney.Pq Dq # 366dea673e9SRodney W. Grimescharacter are ignored. 367dea673e9SRodney W. Grimes.Sh EXAMPLES 368dea673e9SRodney W. GrimesA configuration file might appear as follows: 369dea673e9SRodney W. Grimes.Bd -literal 370dea673e9SRodney W. Grimes# Log all kernel messages, authentication messages of 371dea673e9SRodney W. Grimes# level notice or higher and anything of level err or 372dea673e9SRodney W. Grimes# higher to the console. 373dea673e9SRodney W. Grimes# Don't log private authentication messages! 374dea673e9SRodney W. Grimes*.err;kern.*;auth.notice;authpriv.none /dev/console 375dea673e9SRodney W. Grimes 376dea673e9SRodney W. Grimes# Log anything (except mail) of level info or higher. 377dea673e9SRodney W. Grimes# Don't log private authentication messages! 378dea673e9SRodney W. Grimes*.info;mail.none;authpriv.none /var/log/messages 379dea673e9SRodney W. Grimes 3802eec1ab0SPoul-Henning Kamp# Log daemon messages at debug level only 3812eec1ab0SPoul-Henning Kampdaemon.=debug /var/log/daemon.debug 3822eec1ab0SPoul-Henning Kamp 383dea673e9SRodney W. Grimes# The authpriv file has restricted access. 384dea673e9SRodney W. Grimesauthpriv.* /var/log/secure 385dea673e9SRodney W. Grimes 386dea673e9SRodney W. Grimes# Log all the mail messages in one place. 387dea673e9SRodney W. Grimesmail.* /var/log/maillog 388dea673e9SRodney W. Grimes 389dea673e9SRodney W. Grimes# Everybody gets emergency messages, plus log them on another 390dea673e9SRodney W. Grimes# machine. 391dea673e9SRodney W. Grimes*.emerg * 392dea673e9SRodney W. Grimes*.emerg @arpa.berkeley.edu 393dea673e9SRodney W. Grimes 394dea673e9SRodney W. Grimes# Root and Eric get alert and higher messages. 395dea673e9SRodney W. Grimes*.alert root,eric 396dea673e9SRodney W. Grimes 397dea673e9SRodney W. Grimes# Save mail and news errors of level err and higher in a 398dea673e9SRodney W. Grimes# special file. 399dea673e9SRodney W. Grimesuucp,news.crit /var/log/spoolerr 400f8c034f9SJordan K. Hubbard 4015fadfc4cSJoerg Wunsch# Pipe all authentication messages to a filter. 4025fadfc4cSJoerg Wunschauth.* |exec /usr/local/sbin/authfilter 4035fadfc4cSJoerg Wunsch 404f8c034f9SJordan K. Hubbard# Save ftpd transactions along with mail and news 405f8c034f9SJordan K. Hubbard!ftpd 406f8c034f9SJordan K. Hubbard*.* /var/log/spoolerr 407d2b4b1faSJulian Elischer 408fa62586aSBrian Feldman# Log all security messages to a separate file. 409fa62586aSBrian Feldmansecurity.* /var/log/security 4105c620e2dSChris Timmons 4115c620e2dSChris Timmons# Log all writes to /dev/console to a separate file. 4125c620e2dSChris Timmonsconsole.* /var/log/console.log 413dea673e9SRodney W. Grimes.Ed 414481a1902SDavid Malone.Sh IMPLEMENTATION NOTES 415481a1902SDavid MaloneThe 416481a1902SDavid Malone.Dq kern 417481a1902SDavid Malonefacility is usually reserved for messages 418481a1902SDavid Malonegenerated by the local kernel. 419481a1902SDavid MaloneOther messages logged with facility 420481a1902SDavid Malone.Dq kern 421481a1902SDavid Maloneare usually translated to facility 422481a1902SDavid Malone.Dq user . 423481a1902SDavid MaloneThis translation can be disabled, 424481a1902SDavid Malonesee 425481a1902SDavid Malone.Xr syslogd 8 426481a1902SDavid Malonefor details. 427dea673e9SRodney W. Grimes.Sh FILES 428dea673e9SRodney W. Grimes.Bl -tag -width /etc/syslog.conf -compact 429dea673e9SRodney W. Grimes.It Pa /etc/syslog.conf 430dea673e9SRodney W. Grimes.Xr syslogd 8 431b8b7e105SPhilippe Charnierconfiguration file 432dea673e9SRodney W. Grimes.El 433dea673e9SRodney W. Grimes.Sh BUGS 434922a51eeSPhilippe CharnierThe effects of multiple 435922a51eeSPhilippe Charnier.Em selectors 436922a51eeSPhilippe Charnierare sometimes not intuitive. 43724685462SJohn-Mark GurneyFor example 43824685462SJohn-Mark Gurney.Dq mail.crit,*.err 43924685462SJohn-Mark Gurneywill select 44024685462SJohn-Mark Gurney.Dq mail 44124685462SJohn-Mark Gurneyfacility messages at the level of 44224685462SJohn-Mark Gurney.Dq err 44324685462SJohn-Mark Gurneyor higher, not at the level of 44424685462SJohn-Mark Gurney.Dq crit 44524685462SJohn-Mark Gurneyor higher. 446605efc87SJoerg Wunsch.Pp 447605efc87SJoerg WunschIn networked environments, note that not all operating systems 448605efc87SJoerg Wunschimplement the same set of facilities. The facilities 449605efc87SJoerg Wunschauthpriv, cron, ftp, and ntp that are known to this implementation 450605efc87SJoerg Wunschmight be absent on the target system. Even worse, DEC UNIX uses 451605efc87SJoerg Wunschfacility number 10 (which is authpriv in this implementation) to 452605efc87SJoerg Wunschlog events for their AdvFS filesystem. 453dea673e9SRodney W. Grimes.Sh SEE ALSO 454dea673e9SRodney W. Grimes.Xr syslog 3 , 455dea673e9SRodney W. Grimes.Xr syslogd 8 456