1.\" Copyright (c) 1990, 1991, 1993 2.\" The Regents of the University of California. All rights reserved. 3.\" 4.\" Redistribution and use in source and binary forms, with or without 5.\" modification, are permitted provided that the following conditions 6.\" are met: 7.\" 1. Redistributions of source code must retain the above copyright 8.\" notice, this list of conditions and the following disclaimer. 9.\" 2. Redistributions in binary form must reproduce the above copyright 10.\" notice, this list of conditions and the following disclaimer in the 11.\" documentation and/or other materials provided with the distribution. 12.\" 3. All advertising materials mentioning features or use of this software 13.\" must display the following acknowledgement: 14.\" This product includes software developed by the University of 15.\" California, Berkeley and its contributors. 16.\" 4. Neither the name of the University nor the names of its contributors 17.\" may be used to endorse or promote products derived from this software 18.\" without specific prior written permission. 19.\" 20.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 21.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 24.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 25.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 26.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 27.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 29.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 30.\" SUCH DAMAGE. 31.\" 32.\" @(#)syslog.conf.5 8.1 (Berkeley) 6/9/93 33.\" $FreeBSD$ 34.\" 35.Dd June 9, 1993 36.Dt SYSLOG.CONF 5 37.Os 38.Sh NAME 39.Nm syslog.conf 40.Nd 41.Xr syslogd 8 42configuration file 43.Sh DESCRIPTION 44The 45.Nm 46file is the configuration file for the 47.Xr syslogd 8 48program. 49It consists of 50blocks of lines separated by 51.Em program 52and 53.Em hostname 54specifications, 55with each line containing two fields: the 56.Em selector 57field which specifies the types of messages and priorities to which the 58line applies, and an 59.Em action 60field which specifies the action to be taken if a message 61.Xr syslogd 8 62receives matches the selection criteria. 63The 64.Em selector 65field is separated from the 66.Em action 67field by one or more tab characters or spaces. 68.Pp 69Note that if you use spaces as separators, your 70.Pa syslog.conf 71might be incompatible with other Unices or Unix-like systems. 72This functionality was added for the ease of configuration 73(e.g. it is possible to cut-and-paste into 74.Pa syslog.conf 75), 76and to avoid possible mistakes. 77This change however preserves 78backwards compatibility with the old style of the 79.Pa syslog.conf 80(i.e. tab characters only). 81.Pp 82The 83.Em Selectors 84function 85are encoded as a 86.Em facility , 87a period 88.Pq Dq \&. , 89an optional set of comparison flags 90.Pq Bq <=> , 91and a 92.Em level , 93with no intervening white-space. 94Both the 95.Em facility 96and the 97.Em level 98are case insensitive. 99.Pp 100The 101.Em facility 102describes the part of the system generating the message, and is one of 103the following keywords: auth, authpriv, console, cron, daemon, ftp, kern, 104lpr, mail, mark, news, ntp, security, syslog, user, uucp and local0 through 105local7. These keywords (with the exception of mark) correspond to the 106similar 107.Dq Dv LOG_ 108values specified to the 109.Xr openlog 3 110and 111.Xr syslog 3 112library routines. 113.Pp 114The 115.Em comparison flags 116may be used to specify exactly what is logged. 117The default set of comparison flags are 118.Dq => 119(or, if you prefer, 120.Dq >= ) , 121which means that messages from the specified 122.Em facility 123list of a priority 124level equal or greater than 125.Em level 126will be logged. 127.Pp 128The 129.Em level 130describes the severity of the message, and is a keyword from the 131following ordered list (higher to lower): emerg, alert, crit, err, 132warning, notice, info and debug. 133These keywords correspond to the 134similar 135.Dq Dv LOG_ 136values specified to the 137.Xr syslog 3 138library routine. 139.Pp 140Each block of lines is separated from the previous block by a 141.Em program 142or 143.Em hostname 144specification. 145A block will only log messages corresponding to the most recent 146.Em program 147and 148.Em hostname 149specifications given. 150Thus, a block which selects 151.Ql ppp 152as the 153.Em program , 154directly followed by a block that selects messages from the 155.Em hostname 156.Ql dialhost , 157then the second block will only log messages 158from the 159.Xr ppp 8 160program on dialhost. 161.Pp 162A 163.Em program 164specification is a line beginning with 165.Ql #!prog 166or 167.Ql !prog 168(the former is for compatibility with the previous syslogd, if one is sharing 169.Pa syslog.conf 170files, for example) 171and the following blocks will be associated with calls to 172.Xr syslog 3 173from that specific program. 174A 175.Em program 176specification for 177.Ql foo 178will also match any message logged by the kernel with the prefix 179.Ql "foo: " . 180A 181.Em hostname 182specification of the form 183.Ql #+hostname 184or 185.Ql +hostname 186and the following blocks will be applied to messages 187received from the specified hostname. 188Alternatively, a 189.Em hostname 190specification 191.Ql #-hostname 192or 193.Ql -hostname 194causes the following blocks to be applied to messages 195from any host but the one specified. 196If the hostname is given as 197.Ql @ , 198the local hostname will be used. 199A 200.Em program 201or 202.Em hostname 203specification may be reset by giving the program or hostname as 204.Ql * . 205.Pp 206See 207.Xr syslog 3 208for a further descriptions of both the 209.Em facility 210and 211.Em level 212keywords and their significance. 213It's preferred that selections be made on 214.Em facility 215rather than 216.Em program , 217since the latter can easily vary in a networked environment. 218In some cases, 219though, an appropriate 220.Em facility 221simply doesn't exist. 222.Pp 223If a received message matches the specified 224.Em facility 225and is of the specified 226.Em level 227.Em (or a higher level) , 228and the first word in the message after the date matches the 229.Em program , 230the action specified in the 231.Em action 232field will be taken. 233.Pp 234Multiple 235.Em selectors 236may be specified for a single 237.Em action 238by separating them with semicolon 239.Pq Dq \&; 240characters. 241It is important to note, however, that each 242.Em selector 243can modify the ones preceding it. 244.Pp 245Multiple 246.Em facilities 247may be specified for a single 248.Em level 249by separating them with comma 250.Pq Dq \&, 251characters. 252.Pp 253An asterisk 254.Pq Dq * 255can be used to specify all 256.Em facilities 257all 258.Em levels 259or all 260.Em programs . 261.Pp 262The special 263.Em facility 264.Dq mark 265receives a message at priority 266.Dq info 267every 20 minutes 268(see 269.Xr syslogd 8 ) . 270This is not enabled by a 271.Em facility 272field containing an asterisk. 273.Pp 274The special 275.Em level 276.Dq none 277disables a particular 278.Em facility . 279.Pp 280The 281.Em action 282field of each line specifies the action to be taken when the 283.Em selector 284field selects a message. 285There are five forms: 286.Bl -bullet 287.It 288A pathname (beginning with a leading slash). 289Selected messages are appended to the file. 290.It 291A hostname (preceded by an at 292.Pq Dq @ 293sign). 294Selected messages are forwarded to the 295.Xr syslogd 8 296program on the named host. 297.It 298A comma separated list of users. 299Selected messages are written to those users 300if they are logged in. 301.It 302An asterisk. 303Selected messages are written to all logged-in users. 304.It 305A vertical bar 306.Pq Dq \&| , 307followed by a command to pipe the selected 308messages to. The command is passed to a 309.Pa /bin/sh 310for evaluation, so usual shell metacharacters or input/output 311redirection can occur. (Note however that redirecting 312.Xr stdio 3 313buffered output from the invoked command can cause additional delays, 314or even lost output data in case a logging subprocess exited with a 315signal.) The command itself runs with 316.Em stdout 317and 318.Em stderr 319redirected to 320.Pa /dev/null . 321Upon receipt of a 322.Dv SIGHUP , 323.Nm 324will close the pipe to the process. If the process didn't exit 325voluntarily, it will be sent a 326.Dv SIGTERM 327signal after a grace period of up to 60 seconds. 328.Pp 329The command will only be started once data arrives that should be piped 330to it. If it exited later, it will be restarted as necessary. So if it 331is desired that the subprocess should get exactly one line of input only 332(which can be very resource-consuming if there are a lot of messages 333flowing quickly), this can be achieved by exiting after just one line of 334input. If necessary, a script wrapper can be written to this effect. 335.Pp 336Unless the command is a full pipeline, it's probably useful to 337start the command with 338.Em exec 339so that the invoking shell process does not wait for the command to 340complete. Warning: the process is started under the UID invoking 341.Xr syslogd 8 , 342normally the superuser. 343.El 344.Pp 345Blank lines and lines whose first non-blank character is a hash 346.Pq Dq # 347character are ignored. 348.Sh EXAMPLES 349.Pp 350A configuration file might appear as follows: 351.Bd -literal 352# Log all kernel messages, authentication messages of 353# level notice or higher and anything of level err or 354# higher to the console. 355# Don't log private authentication messages! 356*.err;kern.*;auth.notice;authpriv.none /dev/console 357 358# Log anything (except mail) of level info or higher. 359# Don't log private authentication messages! 360*.info;mail.none;authpriv.none /var/log/messages 361 362# Log daemon messages at debug level only 363daemon.=debug /var/log/daemon.debug 364 365# The authpriv file has restricted access. 366authpriv.* /var/log/secure 367 368# Log all the mail messages in one place. 369mail.* /var/log/maillog 370 371# Everybody gets emergency messages, plus log them on another 372# machine. 373*.emerg * 374*.emerg @arpa.berkeley.edu 375 376# Root and Eric get alert and higher messages. 377*.alert root,eric 378 379# Save mail and news errors of level err and higher in a 380# special file. 381uucp,news.crit /var/log/spoolerr 382 383# Pipe all authentication messages to a filter. 384auth.* |exec /usr/local/sbin/authfilter 385 386# Save ftpd transactions along with mail and news 387!ftpd 388*.* /var/log/spoolerr 389 390# Log all security messages to a separate file. 391security.* /var/log/security 392 393# Log all writes to /dev/console to a separate file. 394console.* /var/log/console.log 395.Ed 396.Sh IMPLEMENTATION NOTES 397The 398.Dq kern 399facility is usually reserved for messages 400generated by the local kernel. 401Other messages logged with facility 402.Dq kern 403are usually translated to facility 404.Dq user . 405This translation can be disabled, 406see 407.Xr syslogd 8 408for details. 409.Sh FILES 410.Bl -tag -width /etc/syslog.conf -compact 411.It Pa /etc/syslog.conf 412.Xr syslogd 8 413configuration file 414.El 415.Sh BUGS 416The effects of multiple 417.Em selectors 418are sometimes not intuitive. 419For example 420.Dq mail.crit,*.err 421will select 422.Dq mail 423facility messages at the level of 424.Dq err 425or higher, not at the level of 426.Dq crit 427or higher. 428.Pp 429In networked environments, note that not all operating systems 430implement the same set of facilities. The facilities 431authpriv, cron, ftp, and ntp that are known to this implementation 432might be absent on the target system. Even worse, DEC UNIX uses 433facility number 10 (which is authpriv in this implementation) to 434log events for their AdvFS file system. 435.Sh SEE ALSO 436.Xr syslog 3 , 437.Xr syslogd 8 438