1.\" Copyright (c) 1990, 1991, 1993 2.\" The Regents of the University of California. All rights reserved. 3.\" 4.\" Redistribution and use in source and binary forms, with or without 5.\" modification, are permitted provided that the following conditions 6.\" are met: 7.\" 1. Redistributions of source code must retain the above copyright 8.\" notice, this list of conditions and the following disclaimer. 9.\" 2. Redistributions in binary form must reproduce the above copyright 10.\" notice, this list of conditions and the following disclaimer in the 11.\" documentation and/or other materials provided with the distribution. 12.\" 3. All advertising materials mentioning features or use of this software 13.\" must display the following acknowledgement: 14.\" This product includes software developed by the University of 15.\" California, Berkeley and its contributors. 16.\" 4. Neither the name of the University nor the names of its contributors 17.\" may be used to endorse or promote products derived from this software 18.\" without specific prior written permission. 19.\" 20.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 21.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 24.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 25.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 26.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 27.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 29.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 30.\" SUCH DAMAGE. 31.\" 32.\" @(#)syslog.conf.5 8.1 (Berkeley) 6/9/93 33.\" $FreeBSD$ 34.\" 35.Dd June 9, 1993 36.Dt SYSLOG.CONF 5 37.Os 38.Sh NAME 39.Nm syslog.conf 40.Nd 41.Xr syslogd 8 42configuration file 43.Sh DESCRIPTION 44The 45.Nm 46file is the configuration file for the 47.Xr syslogd 8 48program. 49It consists of 50blocks of lines separated by 51.Em program 52and 53.Em hostname 54specifications (separations appear along on the line), 55with each line containing two fields: the 56.Em selector 57field which specifies the types of messages and priorities to which the 58line applies, and an 59.Em action 60field which specifies the action to be taken if a message 61.Xr syslogd 8 62receives matches the selection criteria. 63The 64.Em selector 65field is separated from the 66.Em action 67field by one or more tab characters or spaces. 68.Pp 69Note that if you use spaces as separators, your 70.Nm 71might be incompatible with other Unices or Unix-like systems. 72This functionality was added for ease of configuration 73(e.g. it is possible to cut-and-paste into 74.Nm ) , 75and to avoid possible mistakes. 76This change however preserves 77backwards compatibility with the old style of 78.Nm 79(i.e. tab characters only). 80.Pp 81The 82.Em selectors 83are encoded as a 84.Em facility , 85a period 86.Pq Dq \&. , 87an optional set of comparison flags 88.Pq Oo \&! Oc Op <=> , 89and a 90.Em level , 91with no intervening white-space. 92Both the 93.Em facility 94and the 95.Em level 96are case insensitive. 97.Pp 98The 99.Em facility 100describes the part of the system generating the message, and is one of 101the following keywords: auth, authpriv, console, cron, daemon, ftp, kern, 102lpr, mail, mark, news, ntp, security, syslog, user, uucp and local0 through 103local7. 104These keywords (with the exception of mark) correspond to 105similar 106.Dq Dv LOG_ 107values specified to the 108.Xr openlog 3 109and 110.Xr syslog 3 111library routines. 112.Pp 113The 114.Em comparison flags 115may be used to specify exactly what is logged. 116The default comparison is 117.Dq => 118(or, if you prefer, 119.Dq >= ) , 120which means that messages from the specified 121.Em facility 122list, and of a priority 123level equal to or greater than 124.Em level 125will be logged. 126Comparison flags beginning with 127.Dq Li \&! 128will have their logical sense inverted. 129Thus 130.Dq !=info 131means all levels except info and 132.Dq !notice 133has the same meaning as 134.Dq <notice . 135.Pp 136The 137.Em level 138describes the severity of the message, and is a keyword from the 139following ordered list (higher to lower): emerg, alert, crit, err, 140warning, notice, info and debug. 141These keywords correspond to 142similar 143.Dq Dv LOG_ 144values specified to the 145.Xr syslog 3 146library routine. 147.Pp 148Each block of lines is separated from the previous block by a 149.Em program 150or 151.Em hostname 152specification. 153A block will only log messages corresponding to the most recent 154.Em program 155and 156.Em hostname 157specifications given. 158Thus, with a block which selects 159.Ql ppp 160as the 161.Em program , 162directly followed by a block that selects messages from the 163.Em hostname 164.Ql dialhost , 165the second block will only log messages 166from the 167.Xr ppp 8 168program on dialhost. 169.Pp 170A 171.Em program 172specification is a line beginning with 173.Ql #!prog 174or 175.Ql !prog 176(the former is for compatibility with the previous syslogd, if one is sharing 177.Nm 178files, for example) 179and the following blocks will be associated with calls to 180.Xr syslog 3 181from that specific program. 182A 183.Em program 184specification for 185.Ql foo 186will also match any message logged by the kernel with the prefix 187.Ql "foo: " . 188The 189.Ql #!+prog 190or 191.Ql !+prog 192specification works just like the previous one, 193and the 194.Ql #!-prog 195or 196.Ql !-prog 197specification will match any message but the ones from that 198program. 199Multiple programs may be listed, separated by commas: 200.Ql !prog1,prog2 201matches messages from either program, while 202.Ql !-prog1,prog2 203matches all messages but those from 204.Ql prog1 205or 206.Ql prog2 . 207.Pp 208A 209.Em hostname 210specification of the form 211.Ql #+hostname 212or 213.Ql +hostname 214means the following blocks will be applied to messages 215received from the specified hostname. 216Alternatively, the 217.Em hostname 218specification 219.Ql #-hostname 220or 221.Ql -hostname 222causes the following blocks to be applied to messages 223from any host but the one specified. 224If the hostname is given as 225.Ql @ , 226the local hostname will be used. 227As for program specifications, multiple comma-seprarated 228values may be specified for hostname specifications. 229.Pp 230A 231.Em program 232or 233.Em hostname 234specification may be reset by giving the program or hostname as 235.Ql * . 236.Pp 237See 238.Xr syslog 3 239for further descriptions of both the 240.Em facility 241and 242.Em level 243keywords and their significance. 244It's preferred that selections be made on 245.Em facility 246rather than 247.Em program , 248since the latter can easily vary in a networked environment. 249In some cases, 250though, an appropriate 251.Em facility 252simply doesn't exist. 253.Pp 254If a received message matches the specified 255.Em facility 256and is of the specified 257.Em level 258.Em (or a higher level) , 259and the first word in the message after the date matches the 260.Em program , 261the action specified in the 262.Em action 263field will be taken. 264.Pp 265Multiple 266.Em selectors 267may be specified for a single 268.Em action 269by separating them with semicolon 270.Pq Dq \&; 271characters. 272It is important to note, however, that each 273.Em selector 274can modify the ones preceding it. 275.Pp 276Multiple 277.Em facilities 278may be specified for a single 279.Em level 280by separating them with comma 281.Pq Dq \&, 282characters. 283.Pp 284An asterisk 285.Pq Dq * 286can be used to specify all 287.Em facilities , 288all 289.Em levels , 290or all 291.Em programs . 292.Pp 293The special 294.Em facility 295.Dq mark 296receives a message at priority 297.Dq info 298every 20 minutes 299(see 300.Xr syslogd 8 ) . 301This is not enabled by a 302.Em facility 303field containing an asterisk. 304.Pp 305The special 306.Em level 307.Dq none 308disables a particular 309.Em facility . 310.Pp 311The 312.Em action 313field of each line specifies the action to be taken when the 314.Em selector 315field selects a message. 316There are five forms: 317.Bl -bullet 318.It 319A pathname (beginning with a leading slash). 320Selected messages are appended to the file. 321.It 322A hostname (preceded by an at 323.Pq Dq @ 324sign). 325Selected messages are forwarded to the 326.Xr syslogd 8 327program on the named host. 328.It 329A comma separated list of users. 330Selected messages are written to those users 331if they are logged in. 332.It 333An asterisk. 334Selected messages are written to all logged-in users. 335.It 336A vertical bar 337.Pq Dq \&| , 338followed by a command to pipe the selected 339messages to. The command is passed to 340.Xr sh 1 341for evaluation, so usual shell metacharacters or input/output 342redirection can occur. (Note however that redirecting 343.Xr stdio 3 344buffered output from the invoked command can cause additional delays, 345or even lost output data in case a logging subprocess exited with a 346signal.) The command itself runs with 347.Em stdout 348and 349.Em stderr 350redirected to 351.Pa /dev/null . 352Upon receipt of a 353.Dv SIGHUP , 354.Xr syslogd 8 355will close the pipe to the process. If the process didn't exit 356voluntarily, it will be sent a 357.Dv SIGTERM 358signal after a grace period of up to 60 seconds. 359.Pp 360The command will only be started once data arrives that should be piped 361to it. If it exited later, it will be restarted as necessary. So if it 362is desired that the subprocess should get exactly one line of input only 363(which can be very resource-consuming if there are a lot of messages 364flowing quickly), this can be achieved by exiting after just one line of 365input. If necessary, a script wrapper can be written to this effect. 366.Pp 367Unless the command is a full pipeline, it's probably useful to 368start the command with 369.Em exec 370so that the invoking shell process does not wait for the command to 371complete. Warning: the process is started under the UID invoking 372.Xr syslogd 8 , 373normally the superuser. 374.El 375.Pp 376Blank lines and lines whose first non-blank character is a hash 377.Pq Dq # 378character are ignored. 379.Sh EXAMPLES 380A configuration file might appear as follows: 381.Bd -literal 382# Log all kernel messages, authentication messages of 383# level notice or higher, and anything of level err or 384# higher to the console. 385# Don't log private authentication messages! 386*.err;kern.*;auth.notice;authpriv.none /dev/console 387 388# Log anything (except mail) of level info or higher. 389# Don't log private authentication messages! 390*.info;mail.none;authpriv.none /var/log/messages 391 392# Log daemon messages at debug level only 393daemon.=debug /var/log/daemon.debug 394 395# The authpriv file has restricted access. 396authpriv.* /var/log/secure 397 398# Log all the mail messages in one place. 399mail.* /var/log/maillog 400 401# Everybody gets emergency messages, plus log them on another 402# machine. 403*.emerg * 404*.emerg @arpa.berkeley.edu 405 406# Root and Eric get alert and higher messages. 407*.alert root,eric 408 409# Save mail and news errors of level err and higher in a 410# special file. 411uucp,news.crit /var/log/spoolerr 412 413# Pipe all authentication messages to a filter. 414auth.* |exec /usr/local/sbin/authfilter 415 416# Save ftpd transactions along with mail and news 417!ftpd 418*.* /var/log/spoolerr 419 420# Log all security messages to a separate file. 421security.* /var/log/security 422 423# Log all writes to /dev/console to a separate file. 424console.* /var/log/console.log 425.Ed 426.Sh IMPLEMENTATION NOTES 427The 428.Dq kern 429facility is usually reserved for messages 430generated by the local kernel. 431Other messages logged with facility 432.Dq kern 433are usually translated to facility 434.Dq user . 435This translation can be disabled; 436see 437.Xr syslogd 8 438for details. 439.Sh FILES 440.Bl -tag -width /etc/syslog.conf -compact 441.It Pa /etc/syslog.conf 442.Xr syslogd 8 443configuration file 444.El 445.Sh BUGS 446The effects of multiple 447.Em selectors 448are sometimes not intuitive. 449For example 450.Dq mail.crit,*.err 451will select 452.Dq mail 453facility messages at the level of 454.Dq err 455or higher, not at the level of 456.Dq crit 457or higher. 458.Pp 459In networked environments, note that not all operating systems 460implement the same set of facilities. The facilities 461authpriv, cron, ftp, and ntp that are known to this implementation 462might be absent on the target system. Even worse, DEC UNIX uses 463facility number 10 (which is authpriv in this implementation) to 464log events for their AdvFS file system. 465.Sh SEE ALSO 466.Xr syslog 3 , 467.Xr syslogd 8 468