1dea673e9SRodney W. Grimes.\" Copyright (c) 1990, 1991, 1993 2dea673e9SRodney W. Grimes.\" The Regents of the University of California. All rights reserved. 3dea673e9SRodney W. Grimes.\" 4dea673e9SRodney W. Grimes.\" Redistribution and use in source and binary forms, with or without 5dea673e9SRodney W. Grimes.\" modification, are permitted provided that the following conditions 6dea673e9SRodney W. Grimes.\" are met: 7dea673e9SRodney W. Grimes.\" 1. Redistributions of source code must retain the above copyright 8dea673e9SRodney W. Grimes.\" notice, this list of conditions and the following disclaimer. 9dea673e9SRodney W. Grimes.\" 2. Redistributions in binary form must reproduce the above copyright 10dea673e9SRodney W. Grimes.\" notice, this list of conditions and the following disclaimer in the 11dea673e9SRodney W. Grimes.\" documentation and/or other materials provided with the distribution. 12dea673e9SRodney W. Grimes.\" 4. Neither the name of the University nor the names of its contributors 13dea673e9SRodney W. Grimes.\" may be used to endorse or promote products derived from this software 14dea673e9SRodney W. Grimes.\" without specific prior written permission. 15dea673e9SRodney W. Grimes.\" 16dea673e9SRodney W. Grimes.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 17dea673e9SRodney W. Grimes.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18dea673e9SRodney W. Grimes.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19dea673e9SRodney W. Grimes.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 20dea673e9SRodney W. Grimes.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 21dea673e9SRodney W. Grimes.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 22dea673e9SRodney W. Grimes.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 23dea673e9SRodney W. Grimes.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 24dea673e9SRodney W. Grimes.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 25dea673e9SRodney W. Grimes.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26dea673e9SRodney W. Grimes.\" SUCH DAMAGE. 27dea673e9SRodney W. Grimes.\" 28dea673e9SRodney W. Grimes.\" @(#)syslog.conf.5 8.1 (Berkeley) 6/9/93 2997d92980SPeter Wemm.\" $FreeBSD$ 30dea673e9SRodney W. Grimes.\" 31*fdec22c3SBaptiste Daroussin.Dd November 1, 2016 32dea673e9SRodney W. Grimes.Dt SYSLOG.CONF 5 33dea673e9SRodney W. Grimes.Os 34dea673e9SRodney W. Grimes.Sh NAME 35dea673e9SRodney W. Grimes.Nm syslog.conf 36dea673e9SRodney W. Grimes.Nd 37dea673e9SRodney W. Grimes.Xr syslogd 8 38dea673e9SRodney W. Grimesconfiguration file 39dea673e9SRodney W. Grimes.Sh DESCRIPTION 40dea673e9SRodney W. GrimesThe 4124685462SJohn-Mark Gurney.Nm 42dea673e9SRodney W. Grimesfile is the configuration file for the 43dea673e9SRodney W. Grimes.Xr syslogd 8 44dea673e9SRodney W. Grimesprogram. 45f8c034f9SJordan K. HubbardIt consists of 46f8c034f9SJordan K. Hubbardblocks of lines separated by 47f8c034f9SJordan K. Hubbard.Em program 48a144588dSDavid Maloneand 49a144588dSDavid Malone.Em hostname 50f47dba63SJulian Elischerspecifications (separations appear alone on their lines), 51f8c034f9SJordan K. Hubbardwith each line containing two fields: the 52dea673e9SRodney W. Grimes.Em selector 53dea673e9SRodney W. Grimesfield which specifies the types of messages and priorities to which the 54dea673e9SRodney W. Grimesline applies, and an 55dea673e9SRodney W. Grimes.Em action 56dea673e9SRodney W. Grimesfield which specifies the action to be taken if a message 57922a51eeSPhilippe Charnier.Xr syslogd 8 58dea673e9SRodney W. Grimesreceives matches the selection criteria. 59dea673e9SRodney W. GrimesThe 60dea673e9SRodney W. Grimes.Em selector 61dea673e9SRodney W. Grimesfield is separated from the 62dea673e9SRodney W. Grimes.Em action 6360159a06SJordan K. Hubbardfield by one or more tab characters or spaces. 6460159a06SJordan K. Hubbard.Pp 65*fdec22c3SBaptiste DaroussinA special 66*fdec22c3SBaptiste Daroussin.Em include 67*fdec22c3SBaptiste Daroussinkeyword can be used to include all files with names ending in '.conf' and not 68*fdec22c3SBaptiste Daroussinbeginning with a '.' contained in the directory following the keyword. 69*fdec22c3SBaptiste DaroussinThis keyword can only be used in the first level configuration file. 70*fdec22c3SBaptiste Daroussin.Pp 7160159a06SJordan K. HubbardNote that if you use spaces as separators, your 727ae71655SCrist J. Clark.Nm 7360159a06SJordan K. Hubbardmight be incompatible with other Unices or Unix-like systems. 746b010ec6STom RhodesThis functionality was added for ease of configuration 7507bfccd7SRuslan Ermilov(e.g.\& it is possible to cut-and-paste into 767ae71655SCrist J. Clark.Nm ) , 77f2e366a1SSheldon Hearnand to avoid possible mistakes. 78f2e366a1SSheldon HearnThis change however preserves 796b010ec6STom Rhodesbackwards compatibility with the old style of 807ae71655SCrist J. Clark.Nm 8107bfccd7SRuslan Ermilov(i.e., tab characters only). 82dea673e9SRodney W. Grimes.Pp 83dea673e9SRodney W. GrimesThe 847ae71655SCrist J. Clark.Em selectors 85dea673e9SRodney W. Grimesare encoded as a 86dea673e9SRodney W. Grimes.Em facility , 8724685462SJohn-Mark Gurneya period 8824685462SJohn-Mark Gurney.Pq Dq \&. , 892eec1ab0SPoul-Henning Kampan optional set of comparison flags 90c041c1e0SRuslan Ermilov.Pq Oo \&! Oc Op <=> , 9124685462SJohn-Mark Gurneyand a 92dea673e9SRodney W. Grimes.Em level , 93dea673e9SRodney W. Grimeswith no intervening white-space. 94dea673e9SRodney W. GrimesBoth the 95dea673e9SRodney W. Grimes.Em facility 96dea673e9SRodney W. Grimesand the 97dea673e9SRodney W. Grimes.Em level 98dea673e9SRodney W. Grimesare case insensitive. 99dea673e9SRodney W. Grimes.Pp 100dea673e9SRodney W. GrimesThe 101dea673e9SRodney W. Grimes.Em facility 102dea673e9SRodney W. Grimesdescribes the part of the system generating the message, and is one of 10342c3aae2STom Rhodesthe following keywords: 10442c3aae2STom Rhodes.Cm auth , authpriv , console , cron , daemon , ftp , kern , lpr , 10542c3aae2STom Rhodes.Cm mail , mark , news , ntp , security , syslog , user , uucp , 10642c3aae2STom Rhodesand 10742c3aae2STom Rhodes.Cm local0 10842c3aae2STom Rhodesthrough 10942c3aae2STom Rhodes.Cm local7 . 1106b010ec6STom RhodesThese keywords (with the exception of mark) correspond to 111dea673e9SRodney W. Grimessimilar 112dea673e9SRodney W. Grimes.Dq Dv LOG_ 113dea673e9SRodney W. Grimesvalues specified to the 114dea673e9SRodney W. Grimes.Xr openlog 3 115dea673e9SRodney W. Grimesand 116dea673e9SRodney W. Grimes.Xr syslog 3 117dea673e9SRodney W. Grimeslibrary routines. 118dea673e9SRodney W. Grimes.Pp 119dea673e9SRodney W. GrimesThe 1202eec1ab0SPoul-Henning Kamp.Em comparison flags 1212eec1ab0SPoul-Henning Kampmay be used to specify exactly what is logged. 1226b010ec6STom RhodesThe default comparison is 1232eec1ab0SPoul-Henning Kamp.Dq => 1242eec1ab0SPoul-Henning Kamp(or, if you prefer, 125610a5778SRuslan Ermilov.Dq >= ) , 1262eec1ab0SPoul-Henning Kampwhich means that messages from the specified 1272eec1ab0SPoul-Henning Kamp.Em facility 1286b010ec6STom Rhodeslist, and of a priority 1296b010ec6STom Rhodeslevel equal to or greater than 1302eec1ab0SPoul-Henning Kamp.Em level 1312eec1ab0SPoul-Henning Kampwill be logged. 132ef21d92fSDavid MaloneComparison flags beginning with 133c041c1e0SRuslan Ermilov.Dq Li \&! 134ef21d92fSDavid Malonewill have their logical sense inverted. 135ef21d92fSDavid MaloneThus 136ef21d92fSDavid Malone.Dq !=info 137ef21d92fSDavid Malonemeans all levels except info and 138ef21d92fSDavid Malone.Dq !notice 139ef21d92fSDavid Malonehas the same meaning as 140ef21d92fSDavid Malone.Dq <notice . 1412eec1ab0SPoul-Henning Kamp.Pp 1422eec1ab0SPoul-Henning KampThe 143dea673e9SRodney W. Grimes.Em level 144dea673e9SRodney W. Grimesdescribes the severity of the message, and is a keyword from the 14542c3aae2STom Rhodesfollowing ordered list (higher to lower): 1465b34e708STom Rhodes.Cm emerg , crit , alert , err , warning , notice , info 14742c3aae2STom Rhodesand 14842c3aae2STom Rhodes.Cm debug . 1496b010ec6STom RhodesThese keywords correspond to 150dea673e9SRodney W. Grimessimilar 15124685462SJohn-Mark Gurney.Dq Dv LOG_ 152dea673e9SRodney W. Grimesvalues specified to the 153922a51eeSPhilippe Charnier.Xr syslog 3 154dea673e9SRodney W. Grimeslibrary routine. 155dea673e9SRodney W. Grimes.Pp 156a144588dSDavid MaloneEach block of lines is separated from the previous block by a 157a144588dSDavid Malone.Em program 158f8c034f9SJordan K. Hubbardor 159a144588dSDavid Malone.Em hostname 160a144588dSDavid Malonespecification. 161a144588dSDavid MaloneA block will only log messages corresponding to the most recent 162a144588dSDavid Malone.Em program 163a144588dSDavid Maloneand 164a144588dSDavid Malone.Em hostname 165a144588dSDavid Malonespecifications given. 1666b010ec6STom RhodesThus, with a block which selects 167a144588dSDavid Malone.Ql ppp 168a144588dSDavid Maloneas the 169a144588dSDavid Malone.Em program , 170a144588dSDavid Malonedirectly followed by a block that selects messages from the 171a144588dSDavid Malone.Em hostname 172a144588dSDavid Malone.Ql dialhost , 1736b010ec6STom Rhodesthe second block will only log messages 174a144588dSDavid Malonefrom the 175a144588dSDavid Malone.Xr ppp 8 176a144588dSDavid Maloneprogram on dialhost. 177a144588dSDavid Malone.Pp 178a144588dSDavid MaloneA 179a144588dSDavid Malone.Em program 180a144588dSDavid Malonespecification is a line beginning with 181a144588dSDavid Malone.Ql #!prog 182a144588dSDavid Maloneor 183a144588dSDavid Malone.Ql !prog 184f8c034f9SJordan K. Hubbard(the former is for compatibility with the previous syslogd, if one is sharing 1857ae71655SCrist J. Clark.Nm 186922a51eeSPhilippe Charnierfiles, for example) 187a144588dSDavid Maloneand the following blocks will be associated with calls to 188a144588dSDavid Malone.Xr syslog 3 189a144588dSDavid Malonefrom that specific program. 190a144588dSDavid MaloneA 191a144588dSDavid Malone.Em program 192a144588dSDavid Malonespecification for 193a144588dSDavid Malone.Ql foo 194a144588dSDavid Malonewill also match any message logged by the kernel with the prefix 195a144588dSDavid Malone.Ql "foo: " . 196f50b861cSDaniel C. SobralThe 197f50b861cSDaniel C. Sobral.Ql #!+prog 198f50b861cSDaniel C. Sobralor 199f50b861cSDaniel C. Sobral.Ql !+prog 200f50b861cSDaniel C. Sobralspecification works just like the previous one, 201f50b861cSDaniel C. Sobraland the 202f50b861cSDaniel C. Sobral.Ql #!-prog 203f50b861cSDaniel C. Sobralor 204f50b861cSDaniel C. Sobral.Ql !-prog 205f50b861cSDaniel C. Sobralspecification will match any message but the ones from that 206f50b861cSDaniel C. Sobralprogram. 2077ac1f02eSThomas QuinotMultiple programs may be listed, separated by commas: 2087ac1f02eSThomas Quinot.Ql !prog1,prog2 2097ac1f02eSThomas Quinotmatches messages from either program, while 2107ac1f02eSThomas Quinot.Ql !-prog1,prog2 2117ac1f02eSThomas Quinotmatches all messages but those from 2127ac1f02eSThomas Quinot.Ql prog1 2137ac1f02eSThomas Quinotor 2147ac1f02eSThomas Quinot.Ql prog2 . 2157ac1f02eSThomas Quinot.Pp 216a144588dSDavid MaloneA 217a144588dSDavid Malone.Em hostname 218a144588dSDavid Malonespecification of the form 219a144588dSDavid Malone.Ql #+hostname 220a144588dSDavid Maloneor 221a144588dSDavid Malone.Ql +hostname 2226b010ec6STom Rhodesmeans the following blocks will be applied to messages 223a144588dSDavid Malonereceived from the specified hostname. 2246b010ec6STom RhodesAlternatively, the 225a144588dSDavid Malone.Em hostname 226a144588dSDavid Malonespecification 227a144588dSDavid Malone.Ql #-hostname 228a144588dSDavid Maloneor 229a144588dSDavid Malone.Ql -hostname 230a144588dSDavid Malonecauses the following blocks to be applied to messages 231a144588dSDavid Malonefrom any host but the one specified. 232a144588dSDavid MaloneIf the hostname is given as 233a144588dSDavid Malone.Ql @ , 234a144588dSDavid Malonethe local hostname will be used. 2356fb9b618SGiorgos KeramidasAs for program specifications, multiple comma-separated 2367ac1f02eSThomas Quinotvalues may be specified for hostname specifications. 2377ac1f02eSThomas Quinot.Pp 238a144588dSDavid MaloneA 239a144588dSDavid Malone.Em program 240a144588dSDavid Maloneor 241a144588dSDavid Malone.Em hostname 242a144588dSDavid Malonespecification may be reset by giving the program or hostname as 243a144588dSDavid Malone.Ql * . 244f8c034f9SJordan K. Hubbard.Pp 245dea673e9SRodney W. GrimesSee 246dea673e9SRodney W. Grimes.Xr syslog 3 2476b010ec6STom Rhodesfor further descriptions of both the 248dea673e9SRodney W. Grimes.Em facility 249dea673e9SRodney W. Grimesand 250dea673e9SRodney W. Grimes.Em level 251f2e366a1SSheldon Hearnkeywords and their significance. 25236a142c4SRuslan ErmilovIt is preferred that selections be made on 253f8c034f9SJordan K. Hubbard.Em facility 254f8c034f9SJordan K. Hubbardrather than 255f8c034f9SJordan K. Hubbard.Em program , 256f2e366a1SSheldon Hearnsince the latter can easily vary in a networked environment. 257f2e366a1SSheldon HearnIn some cases, 258f8c034f9SJordan K. Hubbardthough, an appropriate 259f8c034f9SJordan K. Hubbard.Em facility 2600227791bSRuslan Ermilovsimply does not exist. 261dea673e9SRodney W. Grimes.Pp 262dea673e9SRodney W. GrimesIf a received message matches the specified 263dea673e9SRodney W. Grimes.Em facility 264dea673e9SRodney W. Grimesand is of the specified 265dea673e9SRodney W. Grimes.Em level 266dea673e9SRodney W. Grimes.Em (or a higher level) , 267f8c034f9SJordan K. Hubbardand the first word in the message after the date matches the 268f8c034f9SJordan K. Hubbard.Em program , 269dea673e9SRodney W. Grimesthe action specified in the 270dea673e9SRodney W. Grimes.Em action 271dea673e9SRodney W. Grimesfield will be taken. 272dea673e9SRodney W. Grimes.Pp 273dea673e9SRodney W. GrimesMultiple 274dea673e9SRodney W. Grimes.Em selectors 275dea673e9SRodney W. Grimesmay be specified for a single 276dea673e9SRodney W. Grimes.Em action 27724685462SJohn-Mark Gurneyby separating them with semicolon 27824685462SJohn-Mark Gurney.Pq Dq \&; 27924685462SJohn-Mark Gurneycharacters. 280dea673e9SRodney W. GrimesIt is important to note, however, that each 281dea673e9SRodney W. Grimes.Em selector 282dea673e9SRodney W. Grimescan modify the ones preceding it. 283dea673e9SRodney W. Grimes.Pp 284dea673e9SRodney W. GrimesMultiple 285dea673e9SRodney W. Grimes.Em facilities 286dea673e9SRodney W. Grimesmay be specified for a single 287dea673e9SRodney W. Grimes.Em level 28824685462SJohn-Mark Gurneyby separating them with comma 28924685462SJohn-Mark Gurney.Pq Dq \&, 29024685462SJohn-Mark Gurneycharacters. 291dea673e9SRodney W. Grimes.Pp 29224685462SJohn-Mark GurneyAn asterisk 29324685462SJohn-Mark Gurney.Pq Dq * 29424685462SJohn-Mark Gurneycan be used to specify all 2956b010ec6STom Rhodes.Em facilities , 296f8c034f9SJordan K. Hubbardall 2976b010ec6STom Rhodes.Em levels , 298dea673e9SRodney W. Grimesor all 299f8c034f9SJordan K. Hubbard.Em programs . 300dea673e9SRodney W. Grimes.Pp 301dea673e9SRodney W. GrimesThe special 302dea673e9SRodney W. Grimes.Em facility 30324685462SJohn-Mark Gurney.Dq mark 30424685462SJohn-Mark Gurneyreceives a message at priority 30524685462SJohn-Mark Gurney.Dq info 30624685462SJohn-Mark Gurneyevery 20 minutes 307dea673e9SRodney W. Grimes(see 308dea673e9SRodney W. Grimes.Xr syslogd 8 ) . 309dea673e9SRodney W. GrimesThis is not enabled by a 310dea673e9SRodney W. Grimes.Em facility 311dea673e9SRodney W. Grimesfield containing an asterisk. 312dea673e9SRodney W. Grimes.Pp 313dea673e9SRodney W. GrimesThe special 314dea673e9SRodney W. Grimes.Em level 31524685462SJohn-Mark Gurney.Dq none 31624685462SJohn-Mark Gurneydisables a particular 317dea673e9SRodney W. Grimes.Em facility . 318dea673e9SRodney W. Grimes.Pp 319dea673e9SRodney W. GrimesThe 320dea673e9SRodney W. Grimes.Em action 321dea673e9SRodney W. Grimesfield of each line specifies the action to be taken when the 322dea673e9SRodney W. Grimes.Em selector 323dea673e9SRodney W. Grimesfield selects a message. 3245fadfc4cSJoerg WunschThere are five forms: 325dea673e9SRodney W. Grimes.Bl -bullet 326dea673e9SRodney W. Grimes.It 327dea673e9SRodney W. GrimesA pathname (beginning with a leading slash). 328dea673e9SRodney W. GrimesSelected messages are appended to the file. 3290f2ffc4eSDavid Malone.Pp 3300f2ffc4eSDavid MaloneTo ensure that kernel messages are written to disk promptly, 3310f2ffc4eSDavid Malone.Nm 3320f2ffc4eSDavid Malonecalls 3330f2ffc4eSDavid Malone.Xr fsync 2 3340f2ffc4eSDavid Maloneafter writing messages from the kernel. 3350f2ffc4eSDavid MaloneOther messages are not synced explicitly. 3360f2ffc4eSDavid MaloneYou may prefix a pathname with the minus sign, 3370f2ffc4eSDavid Malone.Dq - , 3380f2ffc4eSDavid Maloneto forego syncing the specified file after every kernel message. 3390f2ffc4eSDavid MaloneNote that you might lose information if the system crashes 3400f2ffc4eSDavid Maloneimmediately following a write attempt. 3410f2ffc4eSDavid MaloneNevertheless, using the 3420f2ffc4eSDavid Malone.Dq - 3430f2ffc4eSDavid Maloneoption may improve performance, 3440f2ffc4eSDavid Maloneespecially if the kernel is logging many messages. 345dea673e9SRodney W. Grimes.It 34624685462SJohn-Mark GurneyA hostname (preceded by an at 34724685462SJohn-Mark Gurney.Pq Dq @ 34824685462SJohn-Mark Gurneysign). 349dea673e9SRodney W. GrimesSelected messages are forwarded to the 350922a51eeSPhilippe Charnier.Xr syslogd 8 351dea673e9SRodney W. Grimesprogram on the named host. 352be389c75SJulian ElischerIf a port number is added after a colon 353bc84aa4bSRuslan Ermilov.Pq Ql :\& 354bc84aa4bSRuslan Ermilovthen that port will be used as the destination port 355bc84aa4bSRuslan Ermilovrather than the usual syslog port. 356b5bec591SEitan AdlerIPv6 addresses can be used 357b5bec591SEitan Adlerby surrounding the address portion with 358b5bec591SEitan Adlersquare brackets 359b5bec591SEitan Adler.Po 360b5bec591SEitan Adler.Ql [\& 361b5bec591SEitan Adlerand 362b5bec591SEitan Adler.Ql ]\& 363b5bec591SEitan Adler.Pc . 364dea673e9SRodney W. Grimes.It 365dea673e9SRodney W. GrimesA comma separated list of users. 366dea673e9SRodney W. GrimesSelected messages are written to those users 367dea673e9SRodney W. Grimesif they are logged in. 368dea673e9SRodney W. Grimes.It 369dea673e9SRodney W. GrimesAn asterisk. 370dea673e9SRodney W. GrimesSelected messages are written to all logged-in users. 3715fadfc4cSJoerg Wunsch.It 37224685462SJohn-Mark GurneyA vertical bar 37324685462SJohn-Mark Gurney.Pq Dq \&| , 37424685462SJohn-Mark Gurneyfollowed by a command to pipe the selected 37507bfccd7SRuslan Ermilovmessages to. 37607bfccd7SRuslan ErmilovThe command is passed to 3777ae71655SCrist J. Clark.Xr sh 1 3785fadfc4cSJoerg Wunschfor evaluation, so usual shell metacharacters or input/output 37907bfccd7SRuslan Ermilovredirection can occur. 38007bfccd7SRuslan Ermilov(Note however that redirecting 3815fadfc4cSJoerg Wunsch.Xr stdio 3 3825fadfc4cSJoerg Wunschbuffered output from the invoked command can cause additional delays, 3835fadfc4cSJoerg Wunschor even lost output data in case a logging subprocess exited with a 384455fb174SRuslan Ermilovsignal.) 385455fb174SRuslan ErmilovThe command itself runs with 3865fadfc4cSJoerg Wunsch.Em stdout 3875fadfc4cSJoerg Wunschand 3885fadfc4cSJoerg Wunsch.Em stderr 3895fadfc4cSJoerg Wunschredirected to 3905fadfc4cSJoerg Wunsch.Pa /dev/null . 3915fadfc4cSJoerg WunschUpon receipt of a 3925fadfc4cSJoerg Wunsch.Dv SIGHUP , 3937ae71655SCrist J. Clark.Xr syslogd 8 39407bfccd7SRuslan Ermilovwill close the pipe to the process. 3950227791bSRuslan ErmilovIf the process did not exit 3967fa793ccSMike Pritchardvoluntarily, it will be sent a 3975fadfc4cSJoerg Wunsch.Dv SIGTERM 39881be6c75SJoerg Wunschsignal after a grace period of up to 60 seconds. 3995fadfc4cSJoerg Wunsch.Pp 4007fa793ccSMike PritchardThe command will only be started once data arrives that should be piped 40107bfccd7SRuslan Ermilovto it. 40207bfccd7SRuslan ErmilovIf it exited later, it will be restarted as necessary. 40307bfccd7SRuslan ErmilovSo if it 40481be6c75SJoerg Wunschis desired that the subprocess should get exactly one line of input only 40581be6c75SJoerg Wunsch(which can be very resource-consuming if there are a lot of messages 40681be6c75SJoerg Wunschflowing quickly), this can be achieved by exiting after just one line of 40707bfccd7SRuslan Ermilovinput. 40807bfccd7SRuslan ErmilovIf necessary, a script wrapper can be written to this effect. 4095fadfc4cSJoerg Wunsch.Pp 41036a142c4SRuslan ErmilovUnless the command is a full pipeline, it is probably useful to 4115fadfc4cSJoerg Wunschstart the command with 4125fadfc4cSJoerg Wunsch.Em exec 4135fadfc4cSJoerg Wunschso that the invoking shell process does not wait for the command to 41407bfccd7SRuslan Ermilovcomplete. 41507bfccd7SRuslan ErmilovWarning: the process is started under the UID invoking 4165fadfc4cSJoerg Wunsch.Xr syslogd 8 , 4177fa793ccSMike Pritchardnormally the superuser. 418dea673e9SRodney W. Grimes.El 419dea673e9SRodney W. Grimes.Pp 42024685462SJohn-Mark GurneyBlank lines and lines whose first non-blank character is a hash 42124685462SJohn-Mark Gurney.Pq Dq # 422dea673e9SRodney W. Grimescharacter are ignored. 4237e1535c5SMaxim SobolevIf 4247e1535c5SMaxim Sobolev.Ql # 4257e1535c5SMaxim Sobolevis placed in the middle of the line, the 4267e1535c5SMaxim Sobolev.Ql # 4277e1535c5SMaxim Sobolevcharacter and the rest of the line after it is ignored. 4287e1535c5SMaxim SobolevTo prevent special meaning, the 4297e1535c5SMaxim Sobolev.Ql # 4307e1535c5SMaxim Sobolevcharacter may be escaped with 4317e1535c5SMaxim Sobolev.Ql \e ; 4327e1535c5SMaxim Sobolevin this case preceding 4337e1535c5SMaxim Sobolev.Ql \e 4347e1535c5SMaxim Sobolevis removed and 4357e1535c5SMaxim Sobolev.Ql # 4367e1535c5SMaxim Sobolevis treated as an ordinary character. 43759a3c79dSRuslan Ermilov.Sh IMPLEMENTATION NOTES 43859a3c79dSRuslan ErmilovThe 43959a3c79dSRuslan Ermilov.Dq kern 44059a3c79dSRuslan Ermilovfacility is usually reserved for messages 44159a3c79dSRuslan Ermilovgenerated by the local kernel. 44259a3c79dSRuslan ErmilovOther messages logged with facility 44359a3c79dSRuslan Ermilov.Dq kern 44459a3c79dSRuslan Ermilovare usually translated to facility 44559a3c79dSRuslan Ermilov.Dq user . 44659a3c79dSRuslan ErmilovThis translation can be disabled; 44759a3c79dSRuslan Ermilovsee 44859a3c79dSRuslan Ermilov.Xr syslogd 8 44959a3c79dSRuslan Ermilovfor details. 45059a3c79dSRuslan Ermilov.Sh FILES 45159a3c79dSRuslan Ermilov.Bl -tag -width /etc/syslog.conf -compact 45259a3c79dSRuslan Ermilov.It Pa /etc/syslog.conf 45359a3c79dSRuslan Ermilov.Xr syslogd 8 45459a3c79dSRuslan Ermilovconfiguration file 45559a3c79dSRuslan Ermilov.El 456dea673e9SRodney W. Grimes.Sh EXAMPLES 457dea673e9SRodney W. GrimesA configuration file might appear as follows: 458dea673e9SRodney W. Grimes.Bd -literal 459dea673e9SRodney W. Grimes# Log all kernel messages, authentication messages of 4606b010ec6STom Rhodes# level notice or higher, and anything of level err or 461dea673e9SRodney W. Grimes# higher to the console. 462dea673e9SRodney W. Grimes# Don't log private authentication messages! 4635b34e708STom Rhodes*.err;kern.*;auth.notice;authpriv.none;mail.crit /dev/console 464dea673e9SRodney W. Grimes 465dea673e9SRodney W. Grimes# Log anything (except mail) of level info or higher. 466dea673e9SRodney W. Grimes# Don't log private authentication messages! 467dea673e9SRodney W. Grimes*.info;mail.none;authpriv.none /var/log/messages 468dea673e9SRodney W. Grimes 4692eec1ab0SPoul-Henning Kamp# Log daemon messages at debug level only 4702eec1ab0SPoul-Henning Kampdaemon.=debug /var/log/daemon.debug 4712eec1ab0SPoul-Henning Kamp 472dea673e9SRodney W. Grimes# The authpriv file has restricted access. 473dea673e9SRodney W. Grimesauthpriv.* /var/log/secure 474dea673e9SRodney W. Grimes 475dea673e9SRodney W. Grimes# Log all the mail messages in one place. 476dea673e9SRodney W. Grimesmail.* /var/log/maillog 477dea673e9SRodney W. Grimes 478dea673e9SRodney W. Grimes# Everybody gets emergency messages, plus log them on another 479dea673e9SRodney W. Grimes# machine. 480dea673e9SRodney W. Grimes*.emerg * 481dea673e9SRodney W. Grimes*.emerg @arpa.berkeley.edu 482dea673e9SRodney W. Grimes 483dea673e9SRodney W. Grimes# Root and Eric get alert and higher messages. 484dea673e9SRodney W. Grimes*.alert root,eric 485dea673e9SRodney W. Grimes 486dea673e9SRodney W. Grimes# Save mail and news errors of level err and higher in a 487dea673e9SRodney W. Grimes# special file. 488dea673e9SRodney W. Grimesuucp,news.crit /var/log/spoolerr 489f8c034f9SJordan K. Hubbard 4905fadfc4cSJoerg Wunsch# Pipe all authentication messages to a filter. 4915fadfc4cSJoerg Wunschauth.* |exec /usr/local/sbin/authfilter 4925fadfc4cSJoerg Wunsch 493fa62586aSBrian Feldman# Log all security messages to a separate file. 494fa62586aSBrian Feldmansecurity.* /var/log/security 4955c620e2dSChris Timmons 4965c620e2dSChris Timmons# Log all writes to /dev/console to a separate file. 4975c620e2dSChris Timmonsconsole.* /var/log/console.log 4980f2ffc4eSDavid Malone 4995cd1d3ffSAndriy Gapon# Save ftpd transactions along with mail and news 5005cd1d3ffSAndriy Gapon!ftpd 5015cd1d3ffSAndriy Gapon*.* /var/log/spoolerr 5025cd1d3ffSAndriy Gapon 5030f2ffc4eSDavid Malone# Log ipfw messages without syncing after every message. 5040f2ffc4eSDavid Malone!ipfw 5050f2ffc4eSDavid Malone*.* -/var/log/ipfw 506dea673e9SRodney W. Grimes.Ed 50759a3c79dSRuslan Ermilov.Sh SEE ALSO 50859a3c79dSRuslan Ermilov.Xr syslog 3 , 509481a1902SDavid Malone.Xr syslogd 8 510dea673e9SRodney W. Grimes.Sh BUGS 511922a51eeSPhilippe CharnierThe effects of multiple 512922a51eeSPhilippe Charnier.Em selectors 513922a51eeSPhilippe Charnierare sometimes not intuitive. 51424685462SJohn-Mark GurneyFor example 51524685462SJohn-Mark Gurney.Dq mail.crit,*.err 51624685462SJohn-Mark Gurneywill select 51724685462SJohn-Mark Gurney.Dq mail 51824685462SJohn-Mark Gurneyfacility messages at the level of 51924685462SJohn-Mark Gurney.Dq err 52024685462SJohn-Mark Gurneyor higher, not at the level of 52124685462SJohn-Mark Gurney.Dq crit 52224685462SJohn-Mark Gurneyor higher. 523605efc87SJoerg Wunsch.Pp 524605efc87SJoerg WunschIn networked environments, note that not all operating systems 52507bfccd7SRuslan Ermilovimplement the same set of facilities. 52607bfccd7SRuslan ErmilovThe facilities 527605efc87SJoerg Wunschauthpriv, cron, ftp, and ntp that are known to this implementation 52807bfccd7SRuslan Ermilovmight be absent on the target system. 52907bfccd7SRuslan ErmilovEven worse, DEC UNIX uses 530605efc87SJoerg Wunschfacility number 10 (which is authpriv in this implementation) to 531605efc87SJoerg Wunschlog events for their AdvFS file system. 532