xref: /freebsd/usr.sbin/syslogd/syslog.conf.5 (revision fdec22c37de05201437d1199d46a1de396928754)
1dea673e9SRodney W. Grimes.\" Copyright (c) 1990, 1991, 1993
2dea673e9SRodney W. Grimes.\"	The Regents of the University of California.  All rights reserved.
3dea673e9SRodney W. Grimes.\"
4dea673e9SRodney W. Grimes.\" Redistribution and use in source and binary forms, with or without
5dea673e9SRodney W. Grimes.\" modification, are permitted provided that the following conditions
6dea673e9SRodney W. Grimes.\" are met:
7dea673e9SRodney W. Grimes.\" 1. Redistributions of source code must retain the above copyright
8dea673e9SRodney W. Grimes.\"    notice, this list of conditions and the following disclaimer.
9dea673e9SRodney W. Grimes.\" 2. Redistributions in binary form must reproduce the above copyright
10dea673e9SRodney W. Grimes.\"    notice, this list of conditions and the following disclaimer in the
11dea673e9SRodney W. Grimes.\"    documentation and/or other materials provided with the distribution.
12dea673e9SRodney W. Grimes.\" 4. Neither the name of the University nor the names of its contributors
13dea673e9SRodney W. Grimes.\"    may be used to endorse or promote products derived from this software
14dea673e9SRodney W. Grimes.\"    without specific prior written permission.
15dea673e9SRodney W. Grimes.\"
16dea673e9SRodney W. Grimes.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
17dea673e9SRodney W. Grimes.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18dea673e9SRodney W. Grimes.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19dea673e9SRodney W. Grimes.\" ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
20dea673e9SRodney W. Grimes.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21dea673e9SRodney W. Grimes.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22dea673e9SRodney W. Grimes.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23dea673e9SRodney W. Grimes.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24dea673e9SRodney W. Grimes.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25dea673e9SRodney W. Grimes.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26dea673e9SRodney W. Grimes.\" SUCH DAMAGE.
27dea673e9SRodney W. Grimes.\"
28dea673e9SRodney W. Grimes.\"     @(#)syslog.conf.5	8.1 (Berkeley) 6/9/93
2997d92980SPeter Wemm.\" $FreeBSD$
30dea673e9SRodney W. Grimes.\"
31*fdec22c3SBaptiste Daroussin.Dd November 1, 2016
32dea673e9SRodney W. Grimes.Dt SYSLOG.CONF 5
33dea673e9SRodney W. Grimes.Os
34dea673e9SRodney W. Grimes.Sh NAME
35dea673e9SRodney W. Grimes.Nm syslog.conf
36dea673e9SRodney W. Grimes.Nd
37dea673e9SRodney W. Grimes.Xr syslogd 8
38dea673e9SRodney W. Grimesconfiguration file
39dea673e9SRodney W. Grimes.Sh DESCRIPTION
40dea673e9SRodney W. GrimesThe
4124685462SJohn-Mark Gurney.Nm
42dea673e9SRodney W. Grimesfile is the configuration file for the
43dea673e9SRodney W. Grimes.Xr syslogd 8
44dea673e9SRodney W. Grimesprogram.
45f8c034f9SJordan K. HubbardIt consists of
46f8c034f9SJordan K. Hubbardblocks of lines separated by
47f8c034f9SJordan K. Hubbard.Em program
48a144588dSDavid Maloneand
49a144588dSDavid Malone.Em hostname
50f47dba63SJulian Elischerspecifications (separations appear alone on their lines),
51f8c034f9SJordan K. Hubbardwith each line containing two fields: the
52dea673e9SRodney W. Grimes.Em selector
53dea673e9SRodney W. Grimesfield which specifies the types of messages and priorities to which the
54dea673e9SRodney W. Grimesline applies, and an
55dea673e9SRodney W. Grimes.Em action
56dea673e9SRodney W. Grimesfield which specifies the action to be taken if a message
57922a51eeSPhilippe Charnier.Xr syslogd 8
58dea673e9SRodney W. Grimesreceives matches the selection criteria.
59dea673e9SRodney W. GrimesThe
60dea673e9SRodney W. Grimes.Em selector
61dea673e9SRodney W. Grimesfield is separated from the
62dea673e9SRodney W. Grimes.Em action
6360159a06SJordan K. Hubbardfield by one or more tab characters or spaces.
6460159a06SJordan K. Hubbard.Pp
65*fdec22c3SBaptiste DaroussinA special
66*fdec22c3SBaptiste Daroussin.Em include
67*fdec22c3SBaptiste Daroussinkeyword can be used to include all files with names ending in '.conf' and not
68*fdec22c3SBaptiste Daroussinbeginning with a '.' contained in the directory following the keyword.
69*fdec22c3SBaptiste DaroussinThis keyword can only be used in the first level configuration file.
70*fdec22c3SBaptiste Daroussin.Pp
7160159a06SJordan K. HubbardNote that if you use spaces as separators, your
727ae71655SCrist J. Clark.Nm
7360159a06SJordan K. Hubbardmight be incompatible with other Unices or Unix-like systems.
746b010ec6STom RhodesThis functionality was added for ease of configuration
7507bfccd7SRuslan Ermilov(e.g.\& it is possible to cut-and-paste into
767ae71655SCrist J. Clark.Nm ) ,
77f2e366a1SSheldon Hearnand to avoid possible mistakes.
78f2e366a1SSheldon HearnThis change however preserves
796b010ec6STom Rhodesbackwards compatibility with the old style of
807ae71655SCrist J. Clark.Nm
8107bfccd7SRuslan Ermilov(i.e., tab characters only).
82dea673e9SRodney W. Grimes.Pp
83dea673e9SRodney W. GrimesThe
847ae71655SCrist J. Clark.Em selectors
85dea673e9SRodney W. Grimesare encoded as a
86dea673e9SRodney W. Grimes.Em facility ,
8724685462SJohn-Mark Gurneya period
8824685462SJohn-Mark Gurney.Pq Dq \&. ,
892eec1ab0SPoul-Henning Kampan optional set of comparison flags
90c041c1e0SRuslan Ermilov.Pq Oo \&! Oc Op <=> ,
9124685462SJohn-Mark Gurneyand a
92dea673e9SRodney W. Grimes.Em level ,
93dea673e9SRodney W. Grimeswith no intervening white-space.
94dea673e9SRodney W. GrimesBoth the
95dea673e9SRodney W. Grimes.Em facility
96dea673e9SRodney W. Grimesand the
97dea673e9SRodney W. Grimes.Em level
98dea673e9SRodney W. Grimesare case insensitive.
99dea673e9SRodney W. Grimes.Pp
100dea673e9SRodney W. GrimesThe
101dea673e9SRodney W. Grimes.Em facility
102dea673e9SRodney W. Grimesdescribes the part of the system generating the message, and is one of
10342c3aae2STom Rhodesthe following keywords:
10442c3aae2STom Rhodes.Cm auth , authpriv , console , cron , daemon , ftp , kern , lpr ,
10542c3aae2STom Rhodes.Cm mail , mark , news , ntp , security , syslog , user , uucp ,
10642c3aae2STom Rhodesand
10742c3aae2STom Rhodes.Cm local0
10842c3aae2STom Rhodesthrough
10942c3aae2STom Rhodes.Cm local7 .
1106b010ec6STom RhodesThese keywords (with the exception of mark) correspond to
111dea673e9SRodney W. Grimessimilar
112dea673e9SRodney W. Grimes.Dq Dv LOG_
113dea673e9SRodney W. Grimesvalues specified to the
114dea673e9SRodney W. Grimes.Xr openlog 3
115dea673e9SRodney W. Grimesand
116dea673e9SRodney W. Grimes.Xr syslog 3
117dea673e9SRodney W. Grimeslibrary routines.
118dea673e9SRodney W. Grimes.Pp
119dea673e9SRodney W. GrimesThe
1202eec1ab0SPoul-Henning Kamp.Em comparison flags
1212eec1ab0SPoul-Henning Kampmay be used to specify exactly what is logged.
1226b010ec6STom RhodesThe default comparison is
1232eec1ab0SPoul-Henning Kamp.Dq =>
1242eec1ab0SPoul-Henning Kamp(or, if you prefer,
125610a5778SRuslan Ermilov.Dq >= ) ,
1262eec1ab0SPoul-Henning Kampwhich means that messages from the specified
1272eec1ab0SPoul-Henning Kamp.Em facility
1286b010ec6STom Rhodeslist, and of a priority
1296b010ec6STom Rhodeslevel equal to or greater than
1302eec1ab0SPoul-Henning Kamp.Em level
1312eec1ab0SPoul-Henning Kampwill be logged.
132ef21d92fSDavid MaloneComparison flags beginning with
133c041c1e0SRuslan Ermilov.Dq Li \&!
134ef21d92fSDavid Malonewill have their logical sense inverted.
135ef21d92fSDavid MaloneThus
136ef21d92fSDavid Malone.Dq !=info
137ef21d92fSDavid Malonemeans all levels except info and
138ef21d92fSDavid Malone.Dq !notice
139ef21d92fSDavid Malonehas the same meaning as
140ef21d92fSDavid Malone.Dq <notice .
1412eec1ab0SPoul-Henning Kamp.Pp
1422eec1ab0SPoul-Henning KampThe
143dea673e9SRodney W. Grimes.Em level
144dea673e9SRodney W. Grimesdescribes the severity of the message, and is a keyword from the
14542c3aae2STom Rhodesfollowing ordered list (higher to lower):
1465b34e708STom Rhodes.Cm emerg , crit , alert , err , warning , notice , info
14742c3aae2STom Rhodesand
14842c3aae2STom Rhodes.Cm debug .
1496b010ec6STom RhodesThese keywords correspond to
150dea673e9SRodney W. Grimessimilar
15124685462SJohn-Mark Gurney.Dq Dv LOG_
152dea673e9SRodney W. Grimesvalues specified to the
153922a51eeSPhilippe Charnier.Xr syslog 3
154dea673e9SRodney W. Grimeslibrary routine.
155dea673e9SRodney W. Grimes.Pp
156a144588dSDavid MaloneEach block of lines is separated from the previous block by a
157a144588dSDavid Malone.Em program
158f8c034f9SJordan K. Hubbardor
159a144588dSDavid Malone.Em hostname
160a144588dSDavid Malonespecification.
161a144588dSDavid MaloneA block will only log messages corresponding to the most recent
162a144588dSDavid Malone.Em program
163a144588dSDavid Maloneand
164a144588dSDavid Malone.Em hostname
165a144588dSDavid Malonespecifications given.
1666b010ec6STom RhodesThus, with a block which selects
167a144588dSDavid Malone.Ql ppp
168a144588dSDavid Maloneas the
169a144588dSDavid Malone.Em program ,
170a144588dSDavid Malonedirectly followed by a block that selects messages from the
171a144588dSDavid Malone.Em hostname
172a144588dSDavid Malone.Ql dialhost ,
1736b010ec6STom Rhodesthe second block will only log messages
174a144588dSDavid Malonefrom the
175a144588dSDavid Malone.Xr ppp 8
176a144588dSDavid Maloneprogram on dialhost.
177a144588dSDavid Malone.Pp
178a144588dSDavid MaloneA
179a144588dSDavid Malone.Em program
180a144588dSDavid Malonespecification is a line beginning with
181a144588dSDavid Malone.Ql #!prog
182a144588dSDavid Maloneor
183a144588dSDavid Malone.Ql !prog
184f8c034f9SJordan K. Hubbard(the former is for compatibility with the previous syslogd, if one is sharing
1857ae71655SCrist J. Clark.Nm
186922a51eeSPhilippe Charnierfiles, for example)
187a144588dSDavid Maloneand the following blocks will be associated with calls to
188a144588dSDavid Malone.Xr syslog 3
189a144588dSDavid Malonefrom that specific program.
190a144588dSDavid MaloneA
191a144588dSDavid Malone.Em program
192a144588dSDavid Malonespecification for
193a144588dSDavid Malone.Ql foo
194a144588dSDavid Malonewill also match any message logged by the kernel with the prefix
195a144588dSDavid Malone.Ql "foo: " .
196f50b861cSDaniel C. SobralThe
197f50b861cSDaniel C. Sobral.Ql #!+prog
198f50b861cSDaniel C. Sobralor
199f50b861cSDaniel C. Sobral.Ql !+prog
200f50b861cSDaniel C. Sobralspecification works just like the previous one,
201f50b861cSDaniel C. Sobraland the
202f50b861cSDaniel C. Sobral.Ql #!-prog
203f50b861cSDaniel C. Sobralor
204f50b861cSDaniel C. Sobral.Ql !-prog
205f50b861cSDaniel C. Sobralspecification will match any message but the ones from that
206f50b861cSDaniel C. Sobralprogram.
2077ac1f02eSThomas QuinotMultiple programs may be listed, separated by commas:
2087ac1f02eSThomas Quinot.Ql !prog1,prog2
2097ac1f02eSThomas Quinotmatches messages from either program, while
2107ac1f02eSThomas Quinot.Ql !-prog1,prog2
2117ac1f02eSThomas Quinotmatches all messages but those from
2127ac1f02eSThomas Quinot.Ql prog1
2137ac1f02eSThomas Quinotor
2147ac1f02eSThomas Quinot.Ql prog2 .
2157ac1f02eSThomas Quinot.Pp
216a144588dSDavid MaloneA
217a144588dSDavid Malone.Em hostname
218a144588dSDavid Malonespecification of the form
219a144588dSDavid Malone.Ql #+hostname
220a144588dSDavid Maloneor
221a144588dSDavid Malone.Ql +hostname
2226b010ec6STom Rhodesmeans the following blocks will be applied to messages
223a144588dSDavid Malonereceived from the specified hostname.
2246b010ec6STom RhodesAlternatively, the
225a144588dSDavid Malone.Em hostname
226a144588dSDavid Malonespecification
227a144588dSDavid Malone.Ql #-hostname
228a144588dSDavid Maloneor
229a144588dSDavid Malone.Ql -hostname
230a144588dSDavid Malonecauses the following blocks to be applied to messages
231a144588dSDavid Malonefrom any host but the one specified.
232a144588dSDavid MaloneIf the hostname is given as
233a144588dSDavid Malone.Ql @ ,
234a144588dSDavid Malonethe local hostname will be used.
2356fb9b618SGiorgos KeramidasAs for program specifications, multiple comma-separated
2367ac1f02eSThomas Quinotvalues may be specified for hostname specifications.
2377ac1f02eSThomas Quinot.Pp
238a144588dSDavid MaloneA
239a144588dSDavid Malone.Em program
240a144588dSDavid Maloneor
241a144588dSDavid Malone.Em hostname
242a144588dSDavid Malonespecification may be reset by giving the program or hostname as
243a144588dSDavid Malone.Ql * .
244f8c034f9SJordan K. Hubbard.Pp
245dea673e9SRodney W. GrimesSee
246dea673e9SRodney W. Grimes.Xr syslog 3
2476b010ec6STom Rhodesfor further descriptions of both the
248dea673e9SRodney W. Grimes.Em facility
249dea673e9SRodney W. Grimesand
250dea673e9SRodney W. Grimes.Em level
251f2e366a1SSheldon Hearnkeywords and their significance.
25236a142c4SRuslan ErmilovIt is preferred that selections be made on
253f8c034f9SJordan K. Hubbard.Em facility
254f8c034f9SJordan K. Hubbardrather than
255f8c034f9SJordan K. Hubbard.Em program ,
256f2e366a1SSheldon Hearnsince the latter can easily vary in a networked environment.
257f2e366a1SSheldon HearnIn some cases,
258f8c034f9SJordan K. Hubbardthough, an appropriate
259f8c034f9SJordan K. Hubbard.Em facility
2600227791bSRuslan Ermilovsimply does not exist.
261dea673e9SRodney W. Grimes.Pp
262dea673e9SRodney W. GrimesIf a received message matches the specified
263dea673e9SRodney W. Grimes.Em facility
264dea673e9SRodney W. Grimesand is of the specified
265dea673e9SRodney W. Grimes.Em level
266dea673e9SRodney W. Grimes.Em (or a higher level) ,
267f8c034f9SJordan K. Hubbardand the first word in the message after the date matches the
268f8c034f9SJordan K. Hubbard.Em program ,
269dea673e9SRodney W. Grimesthe action specified in the
270dea673e9SRodney W. Grimes.Em action
271dea673e9SRodney W. Grimesfield will be taken.
272dea673e9SRodney W. Grimes.Pp
273dea673e9SRodney W. GrimesMultiple
274dea673e9SRodney W. Grimes.Em selectors
275dea673e9SRodney W. Grimesmay be specified for a single
276dea673e9SRodney W. Grimes.Em action
27724685462SJohn-Mark Gurneyby separating them with semicolon
27824685462SJohn-Mark Gurney.Pq Dq \&;
27924685462SJohn-Mark Gurneycharacters.
280dea673e9SRodney W. GrimesIt is important to note, however, that each
281dea673e9SRodney W. Grimes.Em selector
282dea673e9SRodney W. Grimescan modify the ones preceding it.
283dea673e9SRodney W. Grimes.Pp
284dea673e9SRodney W. GrimesMultiple
285dea673e9SRodney W. Grimes.Em facilities
286dea673e9SRodney W. Grimesmay be specified for a single
287dea673e9SRodney W. Grimes.Em level
28824685462SJohn-Mark Gurneyby separating them with comma
28924685462SJohn-Mark Gurney.Pq Dq \&,
29024685462SJohn-Mark Gurneycharacters.
291dea673e9SRodney W. Grimes.Pp
29224685462SJohn-Mark GurneyAn asterisk
29324685462SJohn-Mark Gurney.Pq Dq *
29424685462SJohn-Mark Gurneycan be used to specify all
2956b010ec6STom Rhodes.Em facilities ,
296f8c034f9SJordan K. Hubbardall
2976b010ec6STom Rhodes.Em levels ,
298dea673e9SRodney W. Grimesor all
299f8c034f9SJordan K. Hubbard.Em programs .
300dea673e9SRodney W. Grimes.Pp
301dea673e9SRodney W. GrimesThe special
302dea673e9SRodney W. Grimes.Em facility
30324685462SJohn-Mark Gurney.Dq mark
30424685462SJohn-Mark Gurneyreceives a message at priority
30524685462SJohn-Mark Gurney.Dq info
30624685462SJohn-Mark Gurneyevery 20 minutes
307dea673e9SRodney W. Grimes(see
308dea673e9SRodney W. Grimes.Xr syslogd 8 ) .
309dea673e9SRodney W. GrimesThis is not enabled by a
310dea673e9SRodney W. Grimes.Em facility
311dea673e9SRodney W. Grimesfield containing an asterisk.
312dea673e9SRodney W. Grimes.Pp
313dea673e9SRodney W. GrimesThe special
314dea673e9SRodney W. Grimes.Em level
31524685462SJohn-Mark Gurney.Dq none
31624685462SJohn-Mark Gurneydisables a particular
317dea673e9SRodney W. Grimes.Em facility .
318dea673e9SRodney W. Grimes.Pp
319dea673e9SRodney W. GrimesThe
320dea673e9SRodney W. Grimes.Em action
321dea673e9SRodney W. Grimesfield of each line specifies the action to be taken when the
322dea673e9SRodney W. Grimes.Em selector
323dea673e9SRodney W. Grimesfield selects a message.
3245fadfc4cSJoerg WunschThere are five forms:
325dea673e9SRodney W. Grimes.Bl -bullet
326dea673e9SRodney W. Grimes.It
327dea673e9SRodney W. GrimesA pathname (beginning with a leading slash).
328dea673e9SRodney W. GrimesSelected messages are appended to the file.
3290f2ffc4eSDavid Malone.Pp
3300f2ffc4eSDavid MaloneTo ensure that kernel messages are written to disk promptly,
3310f2ffc4eSDavid Malone.Nm
3320f2ffc4eSDavid Malonecalls
3330f2ffc4eSDavid Malone.Xr fsync 2
3340f2ffc4eSDavid Maloneafter writing messages from the kernel.
3350f2ffc4eSDavid MaloneOther messages are not synced explicitly.
3360f2ffc4eSDavid MaloneYou may prefix a pathname with the minus sign,
3370f2ffc4eSDavid Malone.Dq - ,
3380f2ffc4eSDavid Maloneto forego syncing the specified file after every kernel message.
3390f2ffc4eSDavid MaloneNote that you might lose information if the system crashes
3400f2ffc4eSDavid Maloneimmediately following a write attempt.
3410f2ffc4eSDavid MaloneNevertheless, using the
3420f2ffc4eSDavid Malone.Dq -
3430f2ffc4eSDavid Maloneoption may improve performance,
3440f2ffc4eSDavid Maloneespecially if the kernel is logging many messages.
345dea673e9SRodney W. Grimes.It
34624685462SJohn-Mark GurneyA hostname (preceded by an at
34724685462SJohn-Mark Gurney.Pq Dq @
34824685462SJohn-Mark Gurneysign).
349dea673e9SRodney W. GrimesSelected messages are forwarded to the
350922a51eeSPhilippe Charnier.Xr syslogd 8
351dea673e9SRodney W. Grimesprogram on the named host.
352be389c75SJulian ElischerIf a port number is added after a colon
353bc84aa4bSRuslan Ermilov.Pq Ql :\&
354bc84aa4bSRuslan Ermilovthen that port will be used as the destination port
355bc84aa4bSRuslan Ermilovrather than the usual syslog port.
356b5bec591SEitan AdlerIPv6 addresses can be used
357b5bec591SEitan Adlerby surrounding the address portion with
358b5bec591SEitan Adlersquare brackets
359b5bec591SEitan Adler.Po
360b5bec591SEitan Adler.Ql [\&
361b5bec591SEitan Adlerand
362b5bec591SEitan Adler.Ql ]\&
363b5bec591SEitan Adler.Pc .
364dea673e9SRodney W. Grimes.It
365dea673e9SRodney W. GrimesA comma separated list of users.
366dea673e9SRodney W. GrimesSelected messages are written to those users
367dea673e9SRodney W. Grimesif they are logged in.
368dea673e9SRodney W. Grimes.It
369dea673e9SRodney W. GrimesAn asterisk.
370dea673e9SRodney W. GrimesSelected messages are written to all logged-in users.
3715fadfc4cSJoerg Wunsch.It
37224685462SJohn-Mark GurneyA vertical bar
37324685462SJohn-Mark Gurney.Pq Dq \&| ,
37424685462SJohn-Mark Gurneyfollowed by a command to pipe the selected
37507bfccd7SRuslan Ermilovmessages to.
37607bfccd7SRuslan ErmilovThe command is passed to
3777ae71655SCrist J. Clark.Xr sh 1
3785fadfc4cSJoerg Wunschfor evaluation, so usual shell metacharacters or input/output
37907bfccd7SRuslan Ermilovredirection can occur.
38007bfccd7SRuslan Ermilov(Note however that redirecting
3815fadfc4cSJoerg Wunsch.Xr stdio 3
3825fadfc4cSJoerg Wunschbuffered output from the invoked command can cause additional delays,
3835fadfc4cSJoerg Wunschor even lost output data in case a logging subprocess exited with a
384455fb174SRuslan Ermilovsignal.)
385455fb174SRuslan ErmilovThe command itself runs with
3865fadfc4cSJoerg Wunsch.Em stdout
3875fadfc4cSJoerg Wunschand
3885fadfc4cSJoerg Wunsch.Em stderr
3895fadfc4cSJoerg Wunschredirected to
3905fadfc4cSJoerg Wunsch.Pa /dev/null .
3915fadfc4cSJoerg WunschUpon receipt of a
3925fadfc4cSJoerg Wunsch.Dv SIGHUP ,
3937ae71655SCrist J. Clark.Xr syslogd 8
39407bfccd7SRuslan Ermilovwill close the pipe to the process.
3950227791bSRuslan ErmilovIf the process did not exit
3967fa793ccSMike Pritchardvoluntarily, it will be sent a
3975fadfc4cSJoerg Wunsch.Dv SIGTERM
39881be6c75SJoerg Wunschsignal after a grace period of up to 60 seconds.
3995fadfc4cSJoerg Wunsch.Pp
4007fa793ccSMike PritchardThe command will only be started once data arrives that should be piped
40107bfccd7SRuslan Ermilovto it.
40207bfccd7SRuslan ErmilovIf it exited later, it will be restarted as necessary.
40307bfccd7SRuslan ErmilovSo if it
40481be6c75SJoerg Wunschis desired that the subprocess should get exactly one line of input only
40581be6c75SJoerg Wunsch(which can be very resource-consuming if there are a lot of messages
40681be6c75SJoerg Wunschflowing quickly), this can be achieved by exiting after just one line of
40707bfccd7SRuslan Ermilovinput.
40807bfccd7SRuslan ErmilovIf necessary, a script wrapper can be written to this effect.
4095fadfc4cSJoerg Wunsch.Pp
41036a142c4SRuslan ErmilovUnless the command is a full pipeline, it is probably useful to
4115fadfc4cSJoerg Wunschstart the command with
4125fadfc4cSJoerg Wunsch.Em exec
4135fadfc4cSJoerg Wunschso that the invoking shell process does not wait for the command to
41407bfccd7SRuslan Ermilovcomplete.
41507bfccd7SRuslan ErmilovWarning: the process is started under the UID invoking
4165fadfc4cSJoerg Wunsch.Xr syslogd 8 ,
4177fa793ccSMike Pritchardnormally the superuser.
418dea673e9SRodney W. Grimes.El
419dea673e9SRodney W. Grimes.Pp
42024685462SJohn-Mark GurneyBlank lines and lines whose first non-blank character is a hash
42124685462SJohn-Mark Gurney.Pq Dq #
422dea673e9SRodney W. Grimescharacter are ignored.
4237e1535c5SMaxim SobolevIf
4247e1535c5SMaxim Sobolev.Ql #
4257e1535c5SMaxim Sobolevis placed in the middle of the line, the
4267e1535c5SMaxim Sobolev.Ql #
4277e1535c5SMaxim Sobolevcharacter and the rest of the line after it is ignored.
4287e1535c5SMaxim SobolevTo prevent special meaning, the
4297e1535c5SMaxim Sobolev.Ql #
4307e1535c5SMaxim Sobolevcharacter may be escaped with
4317e1535c5SMaxim Sobolev.Ql \e ;
4327e1535c5SMaxim Sobolevin this case preceding
4337e1535c5SMaxim Sobolev.Ql \e
4347e1535c5SMaxim Sobolevis removed and
4357e1535c5SMaxim Sobolev.Ql #
4367e1535c5SMaxim Sobolevis treated as an ordinary character.
43759a3c79dSRuslan Ermilov.Sh IMPLEMENTATION NOTES
43859a3c79dSRuslan ErmilovThe
43959a3c79dSRuslan Ermilov.Dq kern
44059a3c79dSRuslan Ermilovfacility is usually reserved for messages
44159a3c79dSRuslan Ermilovgenerated by the local kernel.
44259a3c79dSRuslan ErmilovOther messages logged with facility
44359a3c79dSRuslan Ermilov.Dq kern
44459a3c79dSRuslan Ermilovare usually translated to facility
44559a3c79dSRuslan Ermilov.Dq user .
44659a3c79dSRuslan ErmilovThis translation can be disabled;
44759a3c79dSRuslan Ermilovsee
44859a3c79dSRuslan Ermilov.Xr syslogd 8
44959a3c79dSRuslan Ermilovfor details.
45059a3c79dSRuslan Ermilov.Sh FILES
45159a3c79dSRuslan Ermilov.Bl -tag -width /etc/syslog.conf -compact
45259a3c79dSRuslan Ermilov.It Pa /etc/syslog.conf
45359a3c79dSRuslan Ermilov.Xr syslogd 8
45459a3c79dSRuslan Ermilovconfiguration file
45559a3c79dSRuslan Ermilov.El
456dea673e9SRodney W. Grimes.Sh EXAMPLES
457dea673e9SRodney W. GrimesA configuration file might appear as follows:
458dea673e9SRodney W. Grimes.Bd -literal
459dea673e9SRodney W. Grimes# Log all kernel messages, authentication messages of
4606b010ec6STom Rhodes# level notice or higher, and anything of level err or
461dea673e9SRodney W. Grimes# higher to the console.
462dea673e9SRodney W. Grimes# Don't log private authentication messages!
4635b34e708STom Rhodes*.err;kern.*;auth.notice;authpriv.none;mail.crit	/dev/console
464dea673e9SRodney W. Grimes
465dea673e9SRodney W. Grimes# Log anything (except mail) of level info or higher.
466dea673e9SRodney W. Grimes# Don't log private authentication messages!
467dea673e9SRodney W. Grimes*.info;mail.none;authpriv.none		/var/log/messages
468dea673e9SRodney W. Grimes
4692eec1ab0SPoul-Henning Kamp# Log daemon messages at debug level only
4702eec1ab0SPoul-Henning Kampdaemon.=debug						/var/log/daemon.debug
4712eec1ab0SPoul-Henning Kamp
472dea673e9SRodney W. Grimes# The authpriv file has restricted access.
473dea673e9SRodney W. Grimesauthpriv.*						/var/log/secure
474dea673e9SRodney W. Grimes
475dea673e9SRodney W. Grimes# Log all the mail messages in one place.
476dea673e9SRodney W. Grimesmail.*							/var/log/maillog
477dea673e9SRodney W. Grimes
478dea673e9SRodney W. Grimes# Everybody gets emergency messages, plus log them on another
479dea673e9SRodney W. Grimes# machine.
480dea673e9SRodney W. Grimes*.emerg							*
481dea673e9SRodney W. Grimes*.emerg							@arpa.berkeley.edu
482dea673e9SRodney W. Grimes
483dea673e9SRodney W. Grimes# Root and Eric get alert and higher messages.
484dea673e9SRodney W. Grimes*.alert							root,eric
485dea673e9SRodney W. Grimes
486dea673e9SRodney W. Grimes# Save mail and news errors of level err and higher in a
487dea673e9SRodney W. Grimes# special file.
488dea673e9SRodney W. Grimesuucp,news.crit						/var/log/spoolerr
489f8c034f9SJordan K. Hubbard
4905fadfc4cSJoerg Wunsch# Pipe all authentication messages to a filter.
4915fadfc4cSJoerg Wunschauth.*					|exec /usr/local/sbin/authfilter
4925fadfc4cSJoerg Wunsch
493fa62586aSBrian Feldman# Log all security messages to a separate file.
494fa62586aSBrian Feldmansecurity.*						/var/log/security
4955c620e2dSChris Timmons
4965c620e2dSChris Timmons# Log all writes to /dev/console to a separate file.
4975c620e2dSChris Timmonsconsole.*						/var/log/console.log
4980f2ffc4eSDavid Malone
4995cd1d3ffSAndriy Gapon# Save ftpd transactions along with mail and news
5005cd1d3ffSAndriy Gapon!ftpd
5015cd1d3ffSAndriy Gapon*.*							/var/log/spoolerr
5025cd1d3ffSAndriy Gapon
5030f2ffc4eSDavid Malone# Log ipfw messages without syncing after every message.
5040f2ffc4eSDavid Malone!ipfw
5050f2ffc4eSDavid Malone*.*							-/var/log/ipfw
506dea673e9SRodney W. Grimes.Ed
50759a3c79dSRuslan Ermilov.Sh SEE ALSO
50859a3c79dSRuslan Ermilov.Xr syslog 3 ,
509481a1902SDavid Malone.Xr syslogd 8
510dea673e9SRodney W. Grimes.Sh BUGS
511922a51eeSPhilippe CharnierThe effects of multiple
512922a51eeSPhilippe Charnier.Em selectors
513922a51eeSPhilippe Charnierare sometimes not intuitive.
51424685462SJohn-Mark GurneyFor example
51524685462SJohn-Mark Gurney.Dq mail.crit,*.err
51624685462SJohn-Mark Gurneywill select
51724685462SJohn-Mark Gurney.Dq mail
51824685462SJohn-Mark Gurneyfacility messages at the level of
51924685462SJohn-Mark Gurney.Dq err
52024685462SJohn-Mark Gurneyor higher, not at the level of
52124685462SJohn-Mark Gurney.Dq crit
52224685462SJohn-Mark Gurneyor higher.
523605efc87SJoerg Wunsch.Pp
524605efc87SJoerg WunschIn networked environments, note that not all operating systems
52507bfccd7SRuslan Ermilovimplement the same set of facilities.
52607bfccd7SRuslan ErmilovThe facilities
527605efc87SJoerg Wunschauthpriv, cron, ftp, and ntp that are known to this implementation
52807bfccd7SRuslan Ermilovmight be absent on the target system.
52907bfccd7SRuslan ErmilovEven worse, DEC UNIX uses
530605efc87SJoerg Wunschfacility number 10 (which is authpriv in this implementation) to
531605efc87SJoerg Wunschlog events for their AdvFS file system.
532