1.\" Copyright (c) 1990, 1991, 1993 2.\" The Regents of the University of California. All rights reserved. 3.\" 4.\" Redistribution and use in source and binary forms, with or without 5.\" modification, are permitted provided that the following conditions 6.\" are met: 7.\" 1. Redistributions of source code must retain the above copyright 8.\" notice, this list of conditions and the following disclaimer. 9.\" 2. Redistributions in binary form must reproduce the above copyright 10.\" notice, this list of conditions and the following disclaimer in the 11.\" documentation and/or other materials provided with the distribution. 12.\" 3. All advertising materials mentioning features or use of this software 13.\" must display the following acknowledgement: 14.\" This product includes software developed by the University of 15.\" California, Berkeley and its contributors. 16.\" 4. Neither the name of the University nor the names of its contributors 17.\" may be used to endorse or promote products derived from this software 18.\" without specific prior written permission. 19.\" 20.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 21.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 24.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 25.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 26.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 27.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 29.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 30.\" SUCH DAMAGE. 31.\" 32.\" @(#)syslog.conf.5 8.1 (Berkeley) 6/9/93 33.\" $FreeBSD$ 34.\" 35.Dd June 9, 1993 36.Dt SYSLOG.CONF 5 37.Os 38.Sh NAME 39.Nm syslog.conf 40.Nd 41.Xr syslogd 8 42configuration file 43.Sh DESCRIPTION 44The 45.Nm 46file is the configuration file for the 47.Xr syslogd 8 48program. 49It consists of 50blocks of lines separated by 51.Em program 52and 53.Em hostname 54specifications, 55with each line containing two fields: the 56.Em selector 57field which specifies the types of messages and priorities to which the 58line applies, and an 59.Em action 60field which specifies the action to be taken if a message 61.Xr syslogd 8 62receives matches the selection criteria. 63The 64.Em selector 65field is separated from the 66.Em action 67field by one or more tab characters or spaces. 68.Pp 69Note that if you use spaces as separators, your 70.Pa syslog.conf 71might be incompatible with other Unices or Unix-like systems. 72This functionality was added for the ease of configuration 73(e.g. it is possible to cut-and-paste into 74.Pa syslog.conf 75), 76and to avoid possible mistakes. 77This change however preserves 78backwards compatibility with the old style of the 79.Pa syslog.conf 80(i.e. tab characters only). 81.Pp 82The 83.Em Selectors 84function 85are encoded as a 86.Em facility , 87a period 88.Pq Dq \&. , 89an optional set of comparison flags 90.Pq Bq <=> , 91and a 92.Em level , 93with no intervening white-space. 94Both the 95.Em facility 96and the 97.Em level 98are case insensitive. 99.Pp 100The 101.Em facility 102describes the part of the system generating the message, and is one of 103the following keywords: auth, authpriv, console, cron, daemon, ftp, kern, 104lpr, mail, mark, news, ntp, security, syslog, user, uucp and local0 through 105local7. 106These keywords (with the exception of mark) correspond to the 107similar 108.Dq Dv LOG_ 109values specified to the 110.Xr openlog 3 111and 112.Xr syslog 3 113library routines. 114.Pp 115The 116.Em comparison flags 117may be used to specify exactly what is logged. 118The default set of comparison flags are 119.Dq => 120(or, if you prefer, 121.Dq >= ) , 122which means that messages from the specified 123.Em facility 124list of a priority 125level equal or greater than 126.Em level 127will be logged. 128.Pp 129The 130.Em level 131describes the severity of the message, and is a keyword from the 132following ordered list (higher to lower): emerg, alert, crit, err, 133warning, notice, info and debug. 134These keywords correspond to the 135similar 136.Dq Dv LOG_ 137values specified to the 138.Xr syslog 3 139library routine. 140.Pp 141Each block of lines is separated from the previous block by a 142.Em program 143or 144.Em hostname 145specification. 146A block will only log messages corresponding to the most recent 147.Em program 148and 149.Em hostname 150specifications given. 151Thus, a block which selects 152.Ql ppp 153as the 154.Em program , 155directly followed by a block that selects messages from the 156.Em hostname 157.Ql dialhost , 158then the second block will only log messages 159from the 160.Xr ppp 8 161program on dialhost. 162.Pp 163A 164.Em program 165specification is a line beginning with 166.Ql #!prog 167or 168.Ql !prog 169(the former is for compatibility with the previous syslogd, if one is sharing 170.Pa syslog.conf 171files, for example) 172and the following blocks will be associated with calls to 173.Xr syslog 3 174from that specific program. 175A 176.Em program 177specification for 178.Ql foo 179will also match any message logged by the kernel with the prefix 180.Ql "foo: " . 181A 182.Em hostname 183specification of the form 184.Ql #+hostname 185or 186.Ql +hostname 187and the following blocks will be applied to messages 188received from the specified hostname. 189Alternatively, a 190.Em hostname 191specification 192.Ql #-hostname 193or 194.Ql -hostname 195causes the following blocks to be applied to messages 196from any host but the one specified. 197If the hostname is given as 198.Ql @ , 199the local hostname will be used. 200A 201.Em program 202or 203.Em hostname 204specification may be reset by giving the program or hostname as 205.Ql * . 206.Pp 207See 208.Xr syslog 3 209for a further descriptions of both the 210.Em facility 211and 212.Em level 213keywords and their significance. 214It's preferred that selections be made on 215.Em facility 216rather than 217.Em program , 218since the latter can easily vary in a networked environment. 219In some cases, 220though, an appropriate 221.Em facility 222simply doesn't exist. 223.Pp 224If a received message matches the specified 225.Em facility 226and is of the specified 227.Em level 228.Em (or a higher level) , 229and the first word in the message after the date matches the 230.Em program , 231the action specified in the 232.Em action 233field will be taken. 234.Pp 235Multiple 236.Em selectors 237may be specified for a single 238.Em action 239by separating them with semicolon 240.Pq Dq \&; 241characters. 242It is important to note, however, that each 243.Em selector 244can modify the ones preceding it. 245.Pp 246Multiple 247.Em facilities 248may be specified for a single 249.Em level 250by separating them with comma 251.Pq Dq \&, 252characters. 253.Pp 254An asterisk 255.Pq Dq * 256can be used to specify all 257.Em facilities 258all 259.Em levels 260or all 261.Em programs . 262.Pp 263The special 264.Em facility 265.Dq mark 266receives a message at priority 267.Dq info 268every 20 minutes 269(see 270.Xr syslogd 8 ) . 271This is not enabled by a 272.Em facility 273field containing an asterisk. 274.Pp 275The special 276.Em level 277.Dq none 278disables a particular 279.Em facility . 280.Pp 281The 282.Em action 283field of each line specifies the action to be taken when the 284.Em selector 285field selects a message. 286There are five forms: 287.Bl -bullet 288.It 289A pathname (beginning with a leading slash). 290Selected messages are appended to the file. 291.It 292A hostname (preceded by an at 293.Pq Dq @ 294sign). 295Selected messages are forwarded to the 296.Xr syslogd 8 297program on the named host. 298.It 299A comma separated list of users. 300Selected messages are written to those users 301if they are logged in. 302.It 303An asterisk. 304Selected messages are written to all logged-in users. 305.It 306A vertical bar 307.Pq Dq \&| , 308followed by a command to pipe the selected 309messages to. The command is passed to a 310.Pa /bin/sh 311for evaluation, so usual shell metacharacters or input/output 312redirection can occur. (Note however that redirecting 313.Xr stdio 3 314buffered output from the invoked command can cause additional delays, 315or even lost output data in case a logging subprocess exited with a 316signal.) The command itself runs with 317.Em stdout 318and 319.Em stderr 320redirected to 321.Pa /dev/null . 322Upon receipt of a 323.Dv SIGHUP , 324.Nm 325will close the pipe to the process. If the process didn't exit 326voluntarily, it will be sent a 327.Dv SIGTERM 328signal after a grace period of up to 60 seconds. 329.Pp 330The command will only be started once data arrives that should be piped 331to it. If it exited later, it will be restarted as necessary. So if it 332is desired that the subprocess should get exactly one line of input only 333(which can be very resource-consuming if there are a lot of messages 334flowing quickly), this can be achieved by exiting after just one line of 335input. If necessary, a script wrapper can be written to this effect. 336.Pp 337Unless the command is a full pipeline, it's probably useful to 338start the command with 339.Em exec 340so that the invoking shell process does not wait for the command to 341complete. Warning: the process is started under the UID invoking 342.Xr syslogd 8 , 343normally the superuser. 344.El 345.Pp 346Blank lines and lines whose first non-blank character is a hash 347.Pq Dq # 348character are ignored. 349.Sh EXAMPLES 350.Pp 351A configuration file might appear as follows: 352.Bd -literal 353# Log all kernel messages, authentication messages of 354# level notice or higher and anything of level err or 355# higher to the console. 356# Don't log private authentication messages! 357*.err;kern.*;auth.notice;authpriv.none /dev/console 358 359# Log anything (except mail) of level info or higher. 360# Don't log private authentication messages! 361*.info;mail.none;authpriv.none /var/log/messages 362 363# Log daemon messages at debug level only 364daemon.=debug /var/log/daemon.debug 365 366# The authpriv file has restricted access. 367authpriv.* /var/log/secure 368 369# Log all the mail messages in one place. 370mail.* /var/log/maillog 371 372# Everybody gets emergency messages, plus log them on another 373# machine. 374*.emerg * 375*.emerg @arpa.berkeley.edu 376 377# Root and Eric get alert and higher messages. 378*.alert root,eric 379 380# Save mail and news errors of level err and higher in a 381# special file. 382uucp,news.crit /var/log/spoolerr 383 384# Pipe all authentication messages to a filter. 385auth.* |exec /usr/local/sbin/authfilter 386 387# Save ftpd transactions along with mail and news 388!ftpd 389*.* /var/log/spoolerr 390 391# Log all security messages to a separate file. 392security.* /var/log/security 393 394# Log all writes to /dev/console to a separate file. 395console.* /var/log/console.log 396.Ed 397.Sh IMPLEMENTATION NOTES 398The 399.Dq kern 400facility is usually reserved for messages 401generated by the local kernel. 402Other messages logged with facility 403.Dq kern 404are usually translated to facility 405.Dq user . 406This translation can be disabled, 407see 408.Xr syslogd 8 409for details. 410.Sh FILES 411.Bl -tag -width /etc/syslog.conf -compact 412.It Pa /etc/syslog.conf 413.Xr syslogd 8 414configuration file 415.El 416.Sh BUGS 417The effects of multiple 418.Em selectors 419are sometimes not intuitive. 420For example 421.Dq mail.crit,*.err 422will select 423.Dq mail 424facility messages at the level of 425.Dq err 426or higher, not at the level of 427.Dq crit 428or higher. 429.Pp 430In networked environments, note that not all operating systems 431implement the same set of facilities. The facilities 432authpriv, cron, ftp, and ntp that are known to this implementation 433might be absent on the target system. Even worse, DEC UNIX uses 434facility number 10 (which is authpriv in this implementation) to 435log events for their AdvFS file system. 436.Sh SEE ALSO 437.Xr syslog 3 , 438.Xr syslogd 8 439