1.\" Copyright (c) 1990, 1991, 1993 2.\" The Regents of the University of California. All rights reserved. 3.\" 4.\" Redistribution and use in source and binary forms, with or without 5.\" modification, are permitted provided that the following conditions 6.\" are met: 7.\" 1. Redistributions of source code must retain the above copyright 8.\" notice, this list of conditions and the following disclaimer. 9.\" 2. Redistributions in binary form must reproduce the above copyright 10.\" notice, this list of conditions and the following disclaimer in the 11.\" documentation and/or other materials provided with the distribution. 12.\" 3. Neither the name of the University nor the names of its contributors 13.\" may be used to endorse or promote products derived from this software 14.\" without specific prior written permission. 15.\" 16.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 17.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 20.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 21.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 22.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 23.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 24.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 25.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26.\" SUCH DAMAGE. 27.\" 28.\" @(#)syslog.conf.5 8.1 (Berkeley) 6/9/93 29.\" 30.Dd December 10, 2020 31.Dt SYSLOG.CONF 5 32.Os 33.Sh NAME 34.Nm syslog.conf 35.Nd 36.Xr syslogd 8 37configuration file 38.Sh DESCRIPTION 39The 40.Nm 41file is the configuration file for the 42.Xr syslogd 8 43program. 44It consists of 45blocks of lines separated by 46.Em program , 47.Em hostname 48or 49.Em property-based filter 50specifications (separations appear alone on their lines), 51with each line containing two fields: the 52.Em selector 53field which specifies the types of messages and priorities to which the 54line applies, and an 55.Em action 56field which specifies the action to be taken if a message 57.Xr syslogd 8 58receives matches the selection criteria. 59The 60.Em selector 61field is separated from the 62.Em action 63field by one or more tab characters or spaces. 64.Pp 65A special 66.Em include 67keyword can be used to include all files with names ending in '.conf' and not 68beginning with a '.' contained in the directory following the keyword. 69This keyword can only be used in the first level configuration file. 70.Pp 71Note that if you use spaces as separators, your 72.Nm 73might be incompatible with other Unices or Unix-like systems. 74This functionality was added for ease of configuration 75(e.g.,\& it is possible to cut-and-paste into 76.Nm ) , 77and to avoid possible mistakes. 78This change however preserves 79backwards compatibility with the old style of 80.Nm 81(i.e., tab characters only). 82.Pp 83The 84.Em selectors 85are encoded as a 86.Em facility , 87a period 88.Pq Dq \&. , 89an optional set of comparison flags 90.Pq Oo \&! Oc Op <=> , 91and a 92.Em level , 93with no intervening white-space. 94Both the 95.Em facility 96and the 97.Em level 98are case insensitive. 99.Pp 100The 101.Em facility 102describes the part of the system generating the message, and is one of 103the following keywords: 104.Cm auth , authpriv , console , cron , daemon , ftp , kern , lpr , 105.Cm mail , mark , news , ntp , security , syslog , user , uucp , 106and 107.Cm local0 108through 109.Cm local7 . 110These keywords (with the exception of mark) correspond to 111similar 112.Dq Dv LOG_ 113values specified to the 114.Xr openlog 3 115and 116.Xr syslog 3 117library routines. 118.Pp 119The 120.Em comparison flags 121may be used to specify exactly what is logged. 122The default comparison is 123.Dq => 124(or, if you prefer, 125.Dq >= ) , 126which means that messages from the specified 127.Em facility 128list, and of a priority 129level equal to or greater than 130.Em level 131will be logged. 132Comparison flags beginning with 133.Dq Li \&! 134will have their logical sense inverted. 135Thus 136.Dq !=info 137means all levels except info and 138.Dq !notice 139has the same meaning as 140.Dq <notice . 141.Pp 142The 143.Em level 144describes the severity of the message, and is a keyword from the 145following ordered list (higher to lower): 146.Cm emerg , alert , crit , err , warning , notice , info 147and 148.Cm debug . 149These keywords correspond to 150similar 151.Dq Dv LOG_ 152values specified to the 153.Xr syslog 3 154library routine. 155.Pp 156Each block of lines is separated from the previous block by a 157.Em program , 158.Em hostname 159or 160.Em property-based filter 161specification. 162A block will only log messages corresponding to the most recent 163.Em program , 164.Em hostname 165and 166.Em property-based filter 167specifications given. 168Thus, with a block which selects 169.Ql ppp 170as the 171.Em program , 172directly followed by a block that selects messages from the 173.Em hostname 174.Ql dialhost , 175the second block will only log messages 176from the 177.Xr ppp 8 178program on dialhost. 179.Pp 180A 181.Em program 182specification is a line beginning with 183.Ql #!prog 184or 185.Ql !prog 186(the former is for compatibility with the previous syslogd, if one is sharing 187.Nm 188files, for example) 189and the following blocks will be associated with calls to 190.Xr syslog 3 191from that specific program. 192A 193.Em program 194specification for 195.Ql foo 196will also match any message logged by the kernel with the prefix 197.Ql "foo: " . 198The 199.Ql #!+prog 200or 201.Ql !+prog 202specification works just like the previous one, 203and the 204.Ql #!-prog 205or 206.Ql !-prog 207specification will match any message but the ones from that 208program. 209Multiple programs may be listed, separated by commas: 210.Ql !prog1,prog2 211matches messages from either program, while 212.Ql !-prog1,prog2 213matches all messages but those from 214.Ql prog1 215or 216.Ql prog2 . 217.Pp 218A 219.Em hostname 220specification of the form 221.Ql #+hostname 222or 223.Ql +hostname 224means the following blocks will be applied to messages 225received from the specified hostname. 226Alternatively, the 227.Em hostname 228specification 229.Ql #-hostname 230or 231.Ql -hostname 232causes the following blocks to be applied to messages 233from any host but the one specified. 234If the hostname is given as 235.Ql @ , 236the local hostname will be used. 237As for program specifications, multiple comma-separated 238values may be specified for hostname specifications. 239.Pp 240A 241.Em property-based filter 242specification is a line beginning with 243.Ql #: 244or 245.Ql \&: 246and the following blocks will be applied only when filter value 247matches given filter propertie's value. 248See 249.Sx PROPERTY-BASED FILTERS 250section for more details. 251.Pp 252A 253.Em program , 254.Em hostname 255or 256.Em property-based filter 257specification may be reset by giving 258.Ql * 259as an argument. 260.Pp 261See 262.Xr syslog 3 263for further descriptions of both the 264.Em facility 265and 266.Em level 267keywords and their significance. 268It is preferred that selections be made on 269.Em facility 270rather than 271.Em program , 272since the latter can easily vary in a networked environment. 273In some cases, 274though, an appropriate 275.Em facility 276simply does not exist. 277.Pp 278If a received message matches the specified 279.Em facility 280and is of the specified 281.Em level 282.Em (or a higher level) , 283and the first word in the message after the date matches the 284.Em program , 285the action specified in the 286.Em action 287field will be taken. 288.Pp 289Multiple 290.Em selectors 291may be specified for a single 292.Em action 293by separating them with semicolon 294.Pq Dq \&; 295characters. 296It is important to note, however, that each 297.Em selector 298can modify the ones preceding it. 299.Pp 300Multiple 301.Em facilities 302may be specified for a single 303.Em level 304by separating them with comma 305.Pq Dq \&, 306characters. 307.Pp 308An asterisk 309.Pq Dq * 310can be used to specify all 311.Em facilities , 312all 313.Em levels , 314or all 315.Em programs . 316.Pp 317The special 318.Em facility 319.Dq mark 320receives a message at priority 321.Dq info 322every 20 minutes 323(see 324.Xr syslogd 8 ) . 325This is not enabled by a 326.Em facility 327field containing an asterisk. 328.Pp 329The special 330.Em level 331.Dq none 332disables a particular 333.Em facility . 334.Pp 335The 336.Em action 337field of each line specifies the action to be taken when the 338.Em selector 339field selects a message. 340There are five forms: 341.Bl -bullet 342.It 343A pathname (beginning with a leading slash). 344Selected messages are appended to the file. 345.Pp 346To ensure that kernel messages are written to disk promptly, 347.Nm 348calls 349.Xr fsync 2 350after writing messages from the kernel. 351Other messages are not synced explicitly. 352You may prefix a pathname with the minus sign, 353.Dq - , 354to forego syncing the specified file after every kernel message. 355Note that you might lose information if the system crashes 356immediately following a write attempt. 357Nevertheless, using the 358.Dq - 359option may improve performance, 360especially if the kernel is logging many messages. 361.It 362A hostname (preceded by an at 363.Pq Dq @ 364sign). 365Selected messages are forwarded to the 366.Xr syslogd 8 367program on the named host. 368If a port number is added after a colon 369.Pq Ql :\& 370then that port will be used as the destination port 371rather than the usual syslog port. 372IPv6 addresses can be used 373by surrounding the address portion with 374square brackets 375.Po 376.Ql [\& 377and 378.Ql ]\& 379.Pc . 380.It 381A comma separated list of users. 382Selected messages are written to those users 383if they are logged in. 384.It 385An asterisk. 386Selected messages are written to all logged-in users. 387.It 388A vertical bar 389.Pq Dq \&| , 390followed by a command to pipe the selected 391messages to. 392The command is passed to 393.Xr sh 1 394for evaluation, so usual shell metacharacters or input/output 395redirection can occur. 396(Note however that redirecting 397.Xr stdio 3 398buffered output from the invoked command can cause additional delays, 399or even lost output data in case a logging subprocess exited with a 400signal.) 401The command itself runs with 402.Em stdout 403and 404.Em stderr 405redirected to 406.Pa /dev/null . 407Upon receipt of a 408.Dv SIGHUP , 409.Xr syslogd 8 410will close the pipe to the process. 411If the process did not exit 412voluntarily, it will be sent a 413.Dv SIGTERM 414signal after a grace period of up to 60 seconds. 415.Pp 416The command will only be started once data arrives that should be piped 417to it. 418If it exited later, it will be restarted as necessary. 419So if it 420is desired that the subprocess should get exactly one line of input only 421(which can be very resource-consuming if there are a lot of messages 422flowing quickly), this can be achieved by exiting after just one line of 423input. 424If necessary, a script wrapper can be written to this effect. 425.Pp 426Unless the command is a full pipeline, it is probably useful to 427start the command with 428.Em exec 429so that the invoking shell process does not wait for the command to 430complete. 431Warning: the process is started under the UID invoking 432.Xr syslogd 8 , 433normally the superuser. 434.El 435.Pp 436Blank lines and lines whose first non-blank character is a hash 437.Pq Dq # 438character are ignored. 439If 440.Ql # 441is placed in the middle of the line, the 442.Ql # 443character and the rest of the line after it is ignored. 444To prevent special meaning, the 445.Ql # 446character may be escaped with 447.Ql \e ; 448in this case preceding 449.Ql \e 450is removed and 451.Ql # 452is treated as an ordinary character. 453.Sh PROPERTY-BASED FILTERS 454.Em program , 455.Em hostname 456specifications performs exact match filtering against explicit field only. 457.Em Property-based filters 458feature substring and regular expressions (see 459.Xr re_format 7 ) 460matching against various message attributes. 461Filter specification starts with 462.Ql #: 463or 464.Ql \&: 465followed by three comma-separated fields 466.Em property , operator , \&"value\&" . 467Value must be double-quoted. 468A double quote and backslash must be escaped by a backslash. 469.Pp 470Following 471.Em properties 472are supported as test value: 473.Pp 474.Bl -bullet -compact 475.It 476.Ql msg 477- body of the message received. 478.It 479.Ql programname 480- program name sent the message 481.It 482.Ql hostname 483- hostname of message's originator 484.It 485.Ql source 486- an alias for hostname 487.El 488.Pp 489Operator specifies a comparison function between 490.Em propertie's 491 value against filter's value. 492Possible operators: 493.Pp 494.Bl -bullet -compact 495.It 496.Ql contains 497- true if filter value is found as a substring of 498.Em property 499.It 500.Ql isequal 501- true if filter value is equal to 502.Em property 503.It 504.Ql startswith 505- true if property starts with filter value 506.It 507.Ql regex 508- true if property matches basic regular expression defined in filter value 509.It 510.Ql ereregex 511- true if property matches extended regular expression defined in filter value 512.El 513.Pp 514Operator may be prefixed by 515.Pp 516.Bl -bullet -compact 517.It 518.Ql \&! 519- to invert compare logic 520.It 521.Ql icase_ 522- to make comparison function case insensitive 523.El 524.Sh IMPLEMENTATION NOTES 525The 526.Dq kern 527facility is usually reserved for messages 528generated by the local kernel. 529Other messages logged with facility 530.Dq kern 531are usually translated to facility 532.Dq user . 533This translation can be disabled; 534see 535.Xr syslogd 8 536for details. 537.Sh FILES 538.Bl -tag -width /etc/syslog.conf -compact 539.It Pa /etc/syslog.conf 540.Xr syslogd 8 541configuration file 542.El 543.Sh EXAMPLES 544A configuration file might appear as follows: 545.Bd -literal 546# Log all kernel messages, authentication messages of 547# level notice or higher, and anything of level err or 548# higher to the console. 549# Do not log private authentication messages! 550*.err;kern.*;auth.notice;authpriv.none;mail.crit /dev/console 551 552# Log anything (except mail) of level info or higher. 553# Do not log private authentication messages! 554*.info;mail.none;authpriv.none /var/log/messages 555 556# Log daemon messages at debug level only 557daemon.=debug /var/log/daemon.debug 558 559# The authpriv file has restricted access. 560authpriv.* /var/log/secure 561 562# Log all the mail messages in one place. 563mail.* /var/log/maillog 564 565# Everybody gets emergency messages, plus log them on another 566# machine. 567*.emerg * 568*.emerg @arpa.berkeley.edu 569 570# Root and Eric get alert and higher messages. 571*.alert root,eric 572 573# Save mail and news errors of level err and higher in a 574# special file. 575uucp,news.crit /var/log/spoolerr 576 577# Pipe all authentication messages to a filter. 578auth.* |exec /usr/local/sbin/authfilter 579 580# Log all security messages to a separate file. 581security.* /var/log/security 582 583# Log all writes to /dev/console to a separate file. 584console.* /var/log/console.log 585 586# Save ftpd transactions along with mail and news 587!ftpd 588*.* /var/log/spoolerr 589 590# Log ipfw messages without syncing after every message. 591!ipfw 592*.* -/var/log/ipfw 593 594# Log ipfw messages with "Deny" in the message body. 595:msg, contains, ".*Deny.*" 596*.* /var/log/ipfw.deny 597 598# Reset program name filtering 599!* 600 601# Log messages from bird or bird6 into one file 602:programname, regex, "^bird6?$" 603*.* /var/log/bird-all.log 604 605# Log messages from servers in racks 10-19 in multiple locations, case insensitive 606:hostname, icase_ereregex, "^server-(dcA|podB|cdn)-rack1[0-9]{2}\\..*" 607*.* /var/log/racks10..19.log 608.Ed 609.Sh SEE ALSO 610.Xr syslog 3 , 611.Xr syslogd 8 612.Sh BUGS 613The effects of multiple 614.Em selectors 615are sometimes not intuitive. 616For example 617.Dq mail.crit,*.err 618will select 619.Dq mail 620facility messages at the level of 621.Dq err 622or higher, not at the level of 623.Dq crit 624or higher. 625.Pp 626In networked environments, note that not all operating systems 627implement the same set of facilities. 628The facilities 629authpriv, cron, ftp, and ntp that are known to this implementation 630might be absent on the target system. 631Even worse, DEC UNIX uses 632facility number 10 (which is authpriv in this implementation) to 633log events for their AdvFS file system. 634