1.\" Copyright (c) 1990, 1991, 1993 2.\" The Regents of the University of California. All rights reserved. 3.\" 4.\" Redistribution and use in source and binary forms, with or without 5.\" modification, are permitted provided that the following conditions 6.\" are met: 7.\" 1. Redistributions of source code must retain the above copyright 8.\" notice, this list of conditions and the following disclaimer. 9.\" 2. Redistributions in binary form must reproduce the above copyright 10.\" notice, this list of conditions and the following disclaimer in the 11.\" documentation and/or other materials provided with the distribution. 12.\" 3. All advertising materials mentioning features or use of this software 13.\" must display the following acknowledgement: 14.\" This product includes software developed by the University of 15.\" California, Berkeley and its contributors. 16.\" 4. Neither the name of the University nor the names of its contributors 17.\" may be used to endorse or promote products derived from this software 18.\" without specific prior written permission. 19.\" 20.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 21.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 24.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 25.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 26.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 27.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 29.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 30.\" SUCH DAMAGE. 31.\" 32.\" @(#)syslog.conf.5 8.1 (Berkeley) 6/9/93 33.\" $Id: syslog.conf.5,v 1.10 1998/06/10 04:34:54 julian Exp $ 34.\" 35.Dd June 9, 1993 36.Dt SYSLOG.CONF 5 37.Os 38.Sh NAME 39.Nm syslog.conf 40.Nd 41.Xr syslogd 8 42configuration file 43.Sh DESCRIPTION 44The 45.Nm 46file is the configuration file for the 47.Xr syslogd 8 48program. 49It consists of 50blocks of lines separated by 51.Em program 52specifications, 53with each line containing two fields: the 54.Em selector 55field which specifies the types of messages and priorities to which the 56line applies, and an 57.Em action 58field which specifies the action to be taken if a message 59.Xr syslogd 60receives matches the selection criteria. 61The 62.Em selector 63field is separated from the 64.Em action 65field by one or more tab characters. 66.Pp 67The 68.Em Selectors 69function 70are encoded as a 71.Em facility , 72a period 73.Pq Dq \&. , 74an optional set of comparison flags 75.Pq Bq <=> , 76and a 77.Em level , 78with no intervening white-space. 79Both the 80.Em facility 81and the 82.Em level 83are case insensitive. 84.Pp 85The 86.Em facility 87describes the part of the system generating the message, and is one of 88the following keywords: auth, authpriv, cron, daemon, ftp, kern, lpr, mail, 89mark, news, ntp, syslog, user, uucp and local0 through local7. 90These keywords (with the exception of mark) correspond to the 91similar 92.Dq Dv LOG_ 93values specified to the 94.Xr openlog 3 95and 96.Xr syslog 3 97library routines. 98.Pp 99The 100.Em comparison flags 101may be used to specify exactly what is logged. 102The default set of comparison flags are 103.Dq => 104(or, if you prefer, 105.Do >= 106.Dc ), 107which means that messages from the specified 108.Em facility 109list of a priority 110level equal or greater than 111.Em level 112will be logged. 113.Pp 114The 115.Em level 116describes the severity of the message, and is a keyword from the 117following ordered list (higher to lower): emerg, alert, crit, err, 118warning, notice, info and debug. 119These keywords correspond to the 120similar 121.Dq Dv LOG_ 122values specified to the 123.Xr syslog 124library routine. 125.Pp 126Each block of lines is separated from the previous block by a tag. The tag 127is a line beginning with 128.Em #!prog 129or 130.Em !prog 131(the former is for compatibility with the previous syslogd, if one is sharing 132syslog.conf files, for example) 133and each block will be associated with calls to syslog from that specific 134program. A tag for ``foo'' will also match any message logged by the kernel 135with the prefix ``foo: ''. 136.Pp 137See 138.Xr syslog 3 139for a further descriptions of both the 140.Em facility 141and 142.Em level 143keywords and their significance. It's preferred that selections be made on 144.Em facility 145rather than 146.Em program , 147since the latter can easily vary in a networked environment. In some cases, 148though, an appropriate 149.Em facility 150simply doesn't exist. 151.Pp 152If a received message matches the specified 153.Em facility 154and is of the specified 155.Em level 156.Em (or a higher level) , 157and the first word in the message after the date matches the 158.Em program , 159the action specified in the 160.Em action 161field will be taken. 162.Pp 163Multiple 164.Em selectors 165may be specified for a single 166.Em action 167by separating them with semicolon 168.Pq Dq \&; 169characters. 170It is important to note, however, that each 171.Em selector 172can modify the ones preceding it. 173.Pp 174Multiple 175.Em facilities 176may be specified for a single 177.Em level 178by separating them with comma 179.Pq Dq \&, 180characters. 181.Pp 182An asterisk 183.Pq Dq * 184can be used to specify all 185.Em facilities 186all 187.Em levels 188or all 189.Em programs . 190.Pp 191The special 192.Em facility 193.Dq mark 194receives a message at priority 195.Dq info 196every 20 minutes 197(see 198.Xr syslogd 8 ) . 199This is not enabled by a 200.Em facility 201field containing an asterisk. 202.Pp 203The special 204.Em level 205.Dq none 206disables a particular 207.Em facility . 208.Pp 209The 210.Em action 211field of each line specifies the action to be taken when the 212.Em selector 213field selects a message. 214There are five forms: 215.Bl -bullet 216.It 217A pathname (beginning with a leading slash). 218Selected messages are appended to the file. 219.It 220A hostname (preceded by an at 221.Pq Dq @ 222sign). 223Selected messages are forwarded to the 224.Xr syslogd 225program on the named host. 226.It 227A comma separated list of users. 228Selected messages are written to those users 229if they are logged in. 230.It 231An asterisk. 232Selected messages are written to all logged-in users. 233.It 234A vertical bar 235.Pq Dq \&| , 236followed by a command to pipe the selected 237messages to. The command is passed to a 238.Pa /bin/sh 239for evaluation, so usual shell metacharacters or input/output 240redirection can occur. (Note however that redirecting 241.Xr stdio 3 242buffered output from the invoked command can cause additional delays, 243or even lost output data in case a logging subprocess exited with a 244signal.) The command itself runs with 245.Em stdout 246and 247.Em stderr 248redirected to 249.Pa /dev/null . 250Upon receipt of a 251.Dv SIGHUP , 252.Nm 253will close the pipe to the process. If the process didn't exit 254voluntarily, it will be sent a 255.Dv SIGTERM 256signal after a grace period of up to 60 seconds. 257.Pp 258The command will only be started once data arrives that should be piped 259to it. If it exited later, it will be restarted as necessary. So if it 260is desired that the subprocess should get exactly one line of input only 261(which can be very resource-consuming if there are a lot of messages 262flowing quickly), this can be achieved by exiting after just one line of 263input. If necessary, a script wrapper can be written to this effect. 264.Pp 265Unless the command is a full pipeline, it's probably useful to 266start the command with 267.Em exec 268so that the invoking shell process does not wait for the command to 269complete. Warning: the process is started under the UID invoking 270.Xr syslogd 8 , 271normally the superuser. 272.El 273.Pp 274Blank lines and lines whose first non-blank character is a hash 275.Pq Dq # 276character are ignored. 277.Sh EXAMPLES 278.Pp 279A configuration file might appear as follows: 280.Bd -literal 281# Log all kernel messages, authentication messages of 282# level notice or higher and anything of level err or 283# higher to the console. 284# Don't log private authentication messages! 285*.err;kern.*;auth.notice;authpriv.none /dev/console 286 287# Log anything (except mail) of level info or higher. 288# Don't log private authentication messages! 289*.info;mail.none;authpriv.none /var/log/messages 290 291# Log daemon messages at debug level only 292daemon.=debug /var/log/daemon.debug 293 294# The authpriv file has restricted access. 295authpriv.* /var/log/secure 296 297# Log all the mail messages in one place. 298mail.* /var/log/maillog 299 300# Everybody gets emergency messages, plus log them on another 301# machine. 302*.emerg * 303*.emerg @arpa.berkeley.edu 304 305# Root and Eric get alert and higher messages. 306*.alert root,eric 307 308# Save mail and news errors of level err and higher in a 309# special file. 310uucp,news.crit /var/log/spoolerr 311 312# Pipe all authentication messages to a filter. 313auth.* |exec /usr/local/sbin/authfilter 314 315# Save ftpd transactions along with mail and news 316!ftpd 317*.* /var/log/spoolerr 318 319# Log kernel firewall reports to a separate file 320!ipfw 321*.* /var/log/ipfw 322.Ed 323.Sh FILES 324.Bl -tag -width /etc/syslog.conf -compact 325.It Pa /etc/syslog.conf 326.Xr syslogd 8 327configuration file 328.El 329.Sh BUGS 330The effects of multiple selectors are sometimes not intuitive. 331For example 332.Dq mail.crit,*.err 333will select 334.Dq mail 335facility messages at the level of 336.Dq err 337or higher, not at the level of 338.Dq crit 339or higher. 340.Pp 341In networked environments, note that not all operating systems 342implement the same set of facilities. The facilities 343authpriv, cron, ftp, and ntp that are known to this implementation 344might be absent on the target system. Even worse, DEC UNIX uses 345facility number 10 (which is authpriv in this implementation) to 346log events for their AdvFS file system. 347.Sh SEE ALSO 348.Xr syslog 3 , 349.Xr syslogd 8 350