1.\" Copyright (c) 1990, 1991, 1993 2.\" The Regents of the University of California. All rights reserved. 3.\" 4.\" Redistribution and use in source and binary forms, with or without 5.\" modification, are permitted provided that the following conditions 6.\" are met: 7.\" 1. Redistributions of source code must retain the above copyright 8.\" notice, this list of conditions and the following disclaimer. 9.\" 2. Redistributions in binary form must reproduce the above copyright 10.\" notice, this list of conditions and the following disclaimer in the 11.\" documentation and/or other materials provided with the distribution. 12.\" 3. All advertising materials mentioning features or use of this software 13.\" must display the following acknowledgement: 14.\" This product includes software developed by the University of 15.\" California, Berkeley and its contributors. 16.\" 4. Neither the name of the University nor the names of its contributors 17.\" may be used to endorse or promote products derived from this software 18.\" without specific prior written permission. 19.\" 20.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 21.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 24.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 25.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 26.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 27.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 29.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 30.\" SUCH DAMAGE. 31.\" 32.\" @(#)syslog.conf.5 8.1 (Berkeley) 6/9/93 33.\" $FreeBSD$ 34.\" 35.Dd June 9, 1993 36.Dt SYSLOG.CONF 5 37.Os 38.Sh NAME 39.Nm syslog.conf 40.Nd 41.Xr syslogd 8 42configuration file 43.Sh DESCRIPTION 44The 45.Nm 46file is the configuration file for the 47.Xr syslogd 8 48program. 49It consists of 50blocks of lines separated by 51.Em program 52specifications, 53with each line containing two fields: the 54.Em selector 55field which specifies the types of messages and priorities to which the 56line applies, and an 57.Em action 58field which specifies the action to be taken if a message 59.Xr syslogd 8 60receives matches the selection criteria. 61The 62.Em selector 63field is separated from the 64.Em action 65field by one or more tab characters or spaces. 66.Pp 67Note that if you use spaces as separators, your 68.Pa syslog.conf 69might be incompatible with other Unices or Unix-like systems. 70This functionality was added for the ease of configuration 71(e.g. it is possible to cut-and-paste into 72.Pa syslog.conf 73), 74and to avoid possible mistakes. This change however preserves 75backwards compatibility with the old style of the 76.Pa syslog.conf 77(i.e. tab characters only). 78.Pp 79The 80.Em Selectors 81function 82are encoded as a 83.Em facility , 84a period 85.Pq Dq \&. , 86an optional set of comparison flags 87.Pq Bq <=> , 88and a 89.Em level , 90with no intervening white-space. 91Both the 92.Em facility 93and the 94.Em level 95are case insensitive. 96.Pp 97The 98.Em facility 99describes the part of the system generating the message, and is one of 100the following keywords: auth, authpriv, cron, daemon, ftp, kern, lpr, mail, 101mark, news, ntp, syslog, user, uucp, security and local0 through local7. 102These keywords (with the exception of mark) correspond to the 103similar 104.Dq Dv LOG_ 105values specified to the 106.Xr openlog 3 107and 108.Xr syslog 3 109library routines. 110.Pp 111The 112.Em comparison flags 113may be used to specify exactly what is logged. 114The default set of comparison flags are 115.Dq => 116(or, if you prefer, 117.Do >= 118.Dc ), 119which means that messages from the specified 120.Em facility 121list of a priority 122level equal or greater than 123.Em level 124will be logged. 125.Pp 126The 127.Em level 128describes the severity of the message, and is a keyword from the 129following ordered list (higher to lower): emerg, alert, crit, err, 130warning, notice, info and debug. 131These keywords correspond to the 132similar 133.Dq Dv LOG_ 134values specified to the 135.Xr syslog 3 136library routine. 137.Pp 138Each block of lines is separated from the previous block by a tag. The tag 139is a line beginning with 140.Em #!prog 141or 142.Em !prog 143(the former is for compatibility with the previous syslogd, if one is sharing 144.Pa syslog.conf 145files, for example) 146and each block will be associated with calls to syslog from that specific 147program. A tag for ``foo'' will also match any message logged by the kernel 148with the prefix ``foo: ''. 149.Pp 150See 151.Xr syslog 3 152for a further descriptions of both the 153.Em facility 154and 155.Em level 156keywords and their significance. It's preferred that selections be made on 157.Em facility 158rather than 159.Em program , 160since the latter can easily vary in a networked environment. In some cases, 161though, an appropriate 162.Em facility 163simply doesn't exist. 164.Pp 165If a received message matches the specified 166.Em facility 167and is of the specified 168.Em level 169.Em (or a higher level) , 170and the first word in the message after the date matches the 171.Em program , 172the action specified in the 173.Em action 174field will be taken. 175.Pp 176Multiple 177.Em selectors 178may be specified for a single 179.Em action 180by separating them with semicolon 181.Pq Dq \&; 182characters. 183It is important to note, however, that each 184.Em selector 185can modify the ones preceding it. 186.Pp 187Multiple 188.Em facilities 189may be specified for a single 190.Em level 191by separating them with comma 192.Pq Dq \&, 193characters. 194.Pp 195An asterisk 196.Pq Dq * 197can be used to specify all 198.Em facilities 199all 200.Em levels 201or all 202.Em programs . 203.Pp 204The special 205.Em facility 206.Dq mark 207receives a message at priority 208.Dq info 209every 20 minutes 210(see 211.Xr syslogd 8 ) . 212This is not enabled by a 213.Em facility 214field containing an asterisk. 215.Pp 216The special 217.Em level 218.Dq none 219disables a particular 220.Em facility . 221.Pp 222The 223.Em action 224field of each line specifies the action to be taken when the 225.Em selector 226field selects a message. 227There are five forms: 228.Bl -bullet 229.It 230A pathname (beginning with a leading slash). 231Selected messages are appended to the file. 232.It 233A hostname (preceded by an at 234.Pq Dq @ 235sign). 236Selected messages are forwarded to the 237.Xr syslogd 8 238program on the named host. 239.It 240A comma separated list of users. 241Selected messages are written to those users 242if they are logged in. 243.It 244An asterisk. 245Selected messages are written to all logged-in users. 246.It 247A vertical bar 248.Pq Dq \&| , 249followed by a command to pipe the selected 250messages to. The command is passed to a 251.Pa /bin/sh 252for evaluation, so usual shell metacharacters or input/output 253redirection can occur. (Note however that redirecting 254.Xr stdio 3 255buffered output from the invoked command can cause additional delays, 256or even lost output data in case a logging subprocess exited with a 257signal.) The command itself runs with 258.Em stdout 259and 260.Em stderr 261redirected to 262.Pa /dev/null . 263Upon receipt of a 264.Dv SIGHUP , 265.Nm 266will close the pipe to the process. If the process didn't exit 267voluntarily, it will be sent a 268.Dv SIGTERM 269signal after a grace period of up to 60 seconds. 270.Pp 271The command will only be started once data arrives that should be piped 272to it. If it exited later, it will be restarted as necessary. So if it 273is desired that the subprocess should get exactly one line of input only 274(which can be very resource-consuming if there are a lot of messages 275flowing quickly), this can be achieved by exiting after just one line of 276input. If necessary, a script wrapper can be written to this effect. 277.Pp 278Unless the command is a full pipeline, it's probably useful to 279start the command with 280.Em exec 281so that the invoking shell process does not wait for the command to 282complete. Warning: the process is started under the UID invoking 283.Xr syslogd 8 , 284normally the superuser. 285.El 286.Pp 287Blank lines and lines whose first non-blank character is a hash 288.Pq Dq # 289character are ignored. 290.Sh EXAMPLES 291.Pp 292A configuration file might appear as follows: 293.Bd -literal 294# Log all kernel messages, authentication messages of 295# level notice or higher and anything of level err or 296# higher to the console. 297# Don't log private authentication messages! 298*.err;kern.*;auth.notice;authpriv.none /dev/console 299 300# Log anything (except mail) of level info or higher. 301# Don't log private authentication messages! 302*.info;mail.none;authpriv.none /var/log/messages 303 304# Log daemon messages at debug level only 305daemon.=debug /var/log/daemon.debug 306 307# The authpriv file has restricted access. 308authpriv.* /var/log/secure 309 310# Log all the mail messages in one place. 311mail.* /var/log/maillog 312 313# Everybody gets emergency messages, plus log them on another 314# machine. 315*.emerg * 316*.emerg @arpa.berkeley.edu 317 318# Root and Eric get alert and higher messages. 319*.alert root,eric 320 321# Save mail and news errors of level err and higher in a 322# special file. 323uucp,news.crit /var/log/spoolerr 324 325# Pipe all authentication messages to a filter. 326auth.* |exec /usr/local/sbin/authfilter 327 328# Save ftpd transactions along with mail and news 329!ftpd 330*.* /var/log/spoolerr 331 332# Log all security messages to a separate file. 333security.* /var/log/security 334.Ed 335.Sh FILES 336.Bl -tag -width /etc/syslog.conf -compact 337.It Pa /etc/syslog.conf 338.Xr syslogd 8 339configuration file 340.El 341.Sh BUGS 342The effects of multiple 343.Em selectors 344are sometimes not intuitive. 345For example 346.Dq mail.crit,*.err 347will select 348.Dq mail 349facility messages at the level of 350.Dq err 351or higher, not at the level of 352.Dq crit 353or higher. 354.Pp 355In networked environments, note that not all operating systems 356implement the same set of facilities. The facilities 357authpriv, cron, ftp, and ntp that are known to this implementation 358might be absent on the target system. Even worse, DEC UNIX uses 359facility number 10 (which is authpriv in this implementation) to 360log events for their AdvFS file system. 361.Sh SEE ALSO 362.Xr syslog 3 , 363.Xr syslogd 8 364