1.\" Copyright (c) 1990, 1991, 1993 2.\" The Regents of the University of California. All rights reserved. 3.\" 4.\" Redistribution and use in source and binary forms, with or without 5.\" modification, are permitted provided that the following conditions 6.\" are met: 7.\" 1. Redistributions of source code must retain the above copyright 8.\" notice, this list of conditions and the following disclaimer. 9.\" 2. Redistributions in binary form must reproduce the above copyright 10.\" notice, this list of conditions and the following disclaimer in the 11.\" documentation and/or other materials provided with the distribution. 12.\" 3. All advertising materials mentioning features or use of this software 13.\" must display the following acknowledgement: 14.\" This product includes software developed by the University of 15.\" California, Berkeley and its contributors. 16.\" 4. Neither the name of the University nor the names of its contributors 17.\" may be used to endorse or promote products derived from this software 18.\" without specific prior written permission. 19.\" 20.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 21.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 24.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 25.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 26.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 27.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 29.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 30.\" SUCH DAMAGE. 31.\" 32.\" @(#)syslog.conf.5 8.1 (Berkeley) 6/9/93 33.\" $FreeBSD$ 34.\" 35.Dd June 9, 1993 36.Dt SYSLOG.CONF 5 37.Os 38.Sh NAME 39.Nm syslog.conf 40.Nd 41.Xr syslogd 8 42configuration file 43.Sh DESCRIPTION 44The 45.Nm 46file is the configuration file for the 47.Xr syslogd 8 48program. 49It consists of 50blocks of lines separated by 51.Em program 52specifications, 53with each line containing two fields: the 54.Em selector 55field which specifies the types of messages and priorities to which the 56line applies, and an 57.Em action 58field which specifies the action to be taken if a message 59.Xr syslogd 8 60receives matches the selection criteria. 61The 62.Em selector 63field is separated from the 64.Em action 65field by one or more tab characters or spaces. 66.Pp 67Note that if you use spaces as separators, your 68.Pa syslog.conf 69might be incompatible with other Unices or Unix-like systems. 70This functionality was added for the ease of configuration 71(e.g. it is possible to cut-and-paste into 72.Pa syslog.conf 73), 74and to avoid possible mistakes. 75This change however preserves 76backwards compatibility with the old style of the 77.Pa syslog.conf 78(i.e. tab characters only). 79.Pp 80The 81.Em Selectors 82function 83are encoded as a 84.Em facility , 85a period 86.Pq Dq \&. , 87an optional set of comparison flags 88.Pq Bq <=> , 89and a 90.Em level , 91with no intervening white-space. 92Both the 93.Em facility 94and the 95.Em level 96are case insensitive. 97.Pp 98The 99.Em facility 100describes the part of the system generating the message, and is one of 101the following keywords: auth, authpriv, cron, daemon, ftp, kern, lpr, mail, 102mark, news, ntp, syslog, user, uucp, security and local0 through local7. 103These keywords (with the exception of mark) correspond to the 104similar 105.Dq Dv LOG_ 106values specified to the 107.Xr openlog 3 108and 109.Xr syslog 3 110library routines. 111.Pp 112The 113.Em comparison flags 114may be used to specify exactly what is logged. 115The default set of comparison flags are 116.Dq => 117(or, if you prefer, 118.Do >= 119.Dc ), 120which means that messages from the specified 121.Em facility 122list of a priority 123level equal or greater than 124.Em level 125will be logged. 126.Pp 127The 128.Em level 129describes the severity of the message, and is a keyword from the 130following ordered list (higher to lower): emerg, alert, crit, err, 131warning, notice, info and debug. 132These keywords correspond to the 133similar 134.Dq Dv LOG_ 135values specified to the 136.Xr syslog 3 137library routine. 138.Pp 139Each block of lines is separated from the previous block by a tag. 140The tag 141is a line beginning with 142.Em #!prog 143or 144.Em !prog 145(the former is for compatibility with the previous syslogd, if one is sharing 146.Pa syslog.conf 147files, for example) 148and each block will be associated with calls to syslog from that specific 149program. 150A tag for ``foo'' will also match any message logged by the kernel 151with the prefix ``foo: ''. 152.Pp 153See 154.Xr syslog 3 155for a further descriptions of both the 156.Em facility 157and 158.Em level 159keywords and their significance. 160It's preferred that selections be made on 161.Em facility 162rather than 163.Em program , 164since the latter can easily vary in a networked environment. 165In some cases, 166though, an appropriate 167.Em facility 168simply doesn't exist. 169.Pp 170If a received message matches the specified 171.Em facility 172and is of the specified 173.Em level 174.Em (or a higher level) , 175and the first word in the message after the date matches the 176.Em program , 177the action specified in the 178.Em action 179field will be taken. 180.Pp 181Multiple 182.Em selectors 183may be specified for a single 184.Em action 185by separating them with semicolon 186.Pq Dq \&; 187characters. 188It is important to note, however, that each 189.Em selector 190can modify the ones preceding it. 191.Pp 192Multiple 193.Em facilities 194may be specified for a single 195.Em level 196by separating them with comma 197.Pq Dq \&, 198characters. 199.Pp 200An asterisk 201.Pq Dq * 202can be used to specify all 203.Em facilities 204all 205.Em levels 206or all 207.Em programs . 208.Pp 209The special 210.Em facility 211.Dq mark 212receives a message at priority 213.Dq info 214every 20 minutes 215(see 216.Xr syslogd 8 ) . 217This is not enabled by a 218.Em facility 219field containing an asterisk. 220.Pp 221The special 222.Em level 223.Dq none 224disables a particular 225.Em facility . 226.Pp 227The 228.Em action 229field of each line specifies the action to be taken when the 230.Em selector 231field selects a message. 232There are five forms: 233.Bl -bullet 234.It 235A pathname (beginning with a leading slash). 236Selected messages are appended to the file. 237.It 238A hostname (preceded by an at 239.Pq Dq @ 240sign). 241Selected messages are forwarded to the 242.Xr syslogd 8 243program on the named host. 244.It 245A comma separated list of users. 246Selected messages are written to those users 247if they are logged in. 248.It 249An asterisk. 250Selected messages are written to all logged-in users. 251.It 252A vertical bar 253.Pq Dq \&| , 254followed by a command to pipe the selected 255messages to. The command is passed to a 256.Pa /bin/sh 257for evaluation, so usual shell metacharacters or input/output 258redirection can occur. (Note however that redirecting 259.Xr stdio 3 260buffered output from the invoked command can cause additional delays, 261or even lost output data in case a logging subprocess exited with a 262signal.) The command itself runs with 263.Em stdout 264and 265.Em stderr 266redirected to 267.Pa /dev/null . 268Upon receipt of a 269.Dv SIGHUP , 270.Nm 271will close the pipe to the process. If the process didn't exit 272voluntarily, it will be sent a 273.Dv SIGTERM 274signal after a grace period of up to 60 seconds. 275.Pp 276The command will only be started once data arrives that should be piped 277to it. If it exited later, it will be restarted as necessary. So if it 278is desired that the subprocess should get exactly one line of input only 279(which can be very resource-consuming if there are a lot of messages 280flowing quickly), this can be achieved by exiting after just one line of 281input. If necessary, a script wrapper can be written to this effect. 282.Pp 283Unless the command is a full pipeline, it's probably useful to 284start the command with 285.Em exec 286so that the invoking shell process does not wait for the command to 287complete. Warning: the process is started under the UID invoking 288.Xr syslogd 8 , 289normally the superuser. 290.El 291.Pp 292Blank lines and lines whose first non-blank character is a hash 293.Pq Dq # 294character are ignored. 295.Sh EXAMPLES 296.Pp 297A configuration file might appear as follows: 298.Bd -literal 299# Log all kernel messages, authentication messages of 300# level notice or higher and anything of level err or 301# higher to the console. 302# Don't log private authentication messages! 303*.err;kern.*;auth.notice;authpriv.none /dev/console 304 305# Log anything (except mail) of level info or higher. 306# Don't log private authentication messages! 307*.info;mail.none;authpriv.none /var/log/messages 308 309# Log daemon messages at debug level only 310daemon.=debug /var/log/daemon.debug 311 312# The authpriv file has restricted access. 313authpriv.* /var/log/secure 314 315# Log all the mail messages in one place. 316mail.* /var/log/maillog 317 318# Everybody gets emergency messages, plus log them on another 319# machine. 320*.emerg * 321*.emerg @arpa.berkeley.edu 322 323# Root and Eric get alert and higher messages. 324*.alert root,eric 325 326# Save mail and news errors of level err and higher in a 327# special file. 328uucp,news.crit /var/log/spoolerr 329 330# Pipe all authentication messages to a filter. 331auth.* |exec /usr/local/sbin/authfilter 332 333# Save ftpd transactions along with mail and news 334!ftpd 335*.* /var/log/spoolerr 336 337# Log all security messages to a separate file. 338security.* /var/log/security 339.Ed 340.Sh FILES 341.Bl -tag -width /etc/syslog.conf -compact 342.It Pa /etc/syslog.conf 343.Xr syslogd 8 344configuration file 345.El 346.Sh BUGS 347The effects of multiple 348.Em selectors 349are sometimes not intuitive. 350For example 351.Dq mail.crit,*.err 352will select 353.Dq mail 354facility messages at the level of 355.Dq err 356or higher, not at the level of 357.Dq crit 358or higher. 359.Pp 360In networked environments, note that not all operating systems 361implement the same set of facilities. The facilities 362authpriv, cron, ftp, and ntp that are known to this implementation 363might be absent on the target system. Even worse, DEC UNIX uses 364facility number 10 (which is authpriv in this implementation) to 365log events for their AdvFS file system. 366.Sh SEE ALSO 367.Xr syslog 3 , 368.Xr syslogd 8 369