1.\" Copyright (c) 1990, 1991, 1993 2.\" The Regents of the University of California. All rights reserved. 3.\" 4.\" Redistribution and use in source and binary forms, with or without 5.\" modification, are permitted provided that the following conditions 6.\" are met: 7.\" 1. Redistributions of source code must retain the above copyright 8.\" notice, this list of conditions and the following disclaimer. 9.\" 2. Redistributions in binary form must reproduce the above copyright 10.\" notice, this list of conditions and the following disclaimer in the 11.\" documentation and/or other materials provided with the distribution. 12.\" 3. All advertising materials mentioning features or use of this software 13.\" must display the following acknowledgement: 14.\" This product includes software developed by the University of 15.\" California, Berkeley and its contributors. 16.\" 4. Neither the name of the University nor the names of its contributors 17.\" may be used to endorse or promote products derived from this software 18.\" without specific prior written permission. 19.\" 20.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 21.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 24.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 25.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 26.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 27.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 29.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 30.\" SUCH DAMAGE. 31.\" 32.\" @(#)syslog.conf.5 8.1 (Berkeley) 6/9/93 33.\" $FreeBSD$ 34.\" 35.Dd June 9, 1993 36.Dt SYSLOG.CONF 5 37.Os 38.Sh NAME 39.Nm syslog.conf 40.Nd 41.Xr syslogd 8 42configuration file 43.Sh DESCRIPTION 44The 45.Nm 46file is the configuration file for the 47.Xr syslogd 8 48program. 49It consists of 50blocks of lines separated by 51.Em program 52and 53.Em hostname 54specifications, 55with each line containing two fields: the 56.Em selector 57field which specifies the types of messages and priorities to which the 58line applies, and an 59.Em action 60field which specifies the action to be taken if a message 61.Xr syslogd 8 62receives matches the selection criteria. 63The 64.Em selector 65field is separated from the 66.Em action 67field by one or more tab characters or spaces. 68.Pp 69Note that if you use spaces as separators, your 70.Nm 71might be incompatible with other Unices or Unix-like systems. 72This functionality was added for the ease of configuration 73(e.g. it is possible to cut-and-paste into 74.Nm ) , 75and to avoid possible mistakes. 76This change however preserves 77backwards compatibility with the old style of the 78.Nm 79(i.e. tab characters only). 80.Pp 81The 82.Em selectors 83are encoded as a 84.Em facility , 85a period 86.Pq Dq \&. , 87an optional set of comparison flags 88.Pq Bo ! Bc Bq <=> , 89and a 90.Em level , 91with no intervening white-space. 92Both the 93.Em facility 94and the 95.Em level 96are case insensitive. 97.Pp 98The 99.Em facility 100describes the part of the system generating the message, and is one of 101the following keywords: auth, authpriv, console, cron, daemon, ftp, kern, 102lpr, mail, mark, news, ntp, security, syslog, user, uucp and local0 through 103local7. 104These keywords (with the exception of mark) correspond to the 105similar 106.Dq Dv LOG_ 107values specified to the 108.Xr openlog 3 109and 110.Xr syslog 3 111library routines. 112.Pp 113The 114.Em comparison flags 115may be used to specify exactly what is logged. 116The default set of comparison flags are 117.Dq => 118(or, if you prefer, 119.Dq >= ) , 120which means that messages from the specified 121.Em facility 122list of a priority 123level equal or greater than 124.Em level 125will be logged. 126Comparison flags beginning with 127.Do ! Dc 128will have their logical sense inverted. 129Thus 130.Dq !=info 131means all levels except info and 132.Dq !notice 133has the same meaning as 134.Dq <notice . 135.Pp 136The 137.Em level 138describes the severity of the message, and is a keyword from the 139following ordered list (higher to lower): emerg, alert, crit, err, 140warning, notice, info and debug. 141These keywords correspond to the 142similar 143.Dq Dv LOG_ 144values specified to the 145.Xr syslog 3 146library routine. 147.Pp 148Each block of lines is separated from the previous block by a 149.Em program 150or 151.Em hostname 152specification. 153A block will only log messages corresponding to the most recent 154.Em program 155and 156.Em hostname 157specifications given. 158Thus, a block which selects 159.Ql ppp 160as the 161.Em program , 162directly followed by a block that selects messages from the 163.Em hostname 164.Ql dialhost , 165then the second block will only log messages 166from the 167.Xr ppp 8 168program on dialhost. 169.Pp 170A 171.Em program 172specification is a line beginning with 173.Ql #!prog 174or 175.Ql !prog 176(the former is for compatibility with the previous syslogd, if one is sharing 177.Nm 178files, for example) 179and the following blocks will be associated with calls to 180.Xr syslog 3 181from that specific program. 182A 183.Em program 184specification for 185.Ql foo 186will also match any message logged by the kernel with the prefix 187.Ql "foo: " . 188A 189.Em hostname 190specification of the form 191.Ql #+hostname 192or 193.Ql +hostname 194and the following blocks will be applied to messages 195received from the specified hostname. 196Alternatively, a 197.Em hostname 198specification 199.Ql #-hostname 200or 201.Ql -hostname 202causes the following blocks to be applied to messages 203from any host but the one specified. 204If the hostname is given as 205.Ql @ , 206the local hostname will be used. 207A 208.Em program 209or 210.Em hostname 211specification may be reset by giving the program or hostname as 212.Ql * . 213.Pp 214See 215.Xr syslog 3 216for a further descriptions of both the 217.Em facility 218and 219.Em level 220keywords and their significance. 221It's preferred that selections be made on 222.Em facility 223rather than 224.Em program , 225since the latter can easily vary in a networked environment. 226In some cases, 227though, an appropriate 228.Em facility 229simply doesn't exist. 230.Pp 231If a received message matches the specified 232.Em facility 233and is of the specified 234.Em level 235.Em (or a higher level) , 236and the first word in the message after the date matches the 237.Em program , 238the action specified in the 239.Em action 240field will be taken. 241.Pp 242Multiple 243.Em selectors 244may be specified for a single 245.Em action 246by separating them with semicolon 247.Pq Dq \&; 248characters. 249It is important to note, however, that each 250.Em selector 251can modify the ones preceding it. 252.Pp 253Multiple 254.Em facilities 255may be specified for a single 256.Em level 257by separating them with comma 258.Pq Dq \&, 259characters. 260.Pp 261An asterisk 262.Pq Dq * 263can be used to specify all 264.Em facilities 265all 266.Em levels 267or all 268.Em programs . 269.Pp 270The special 271.Em facility 272.Dq mark 273receives a message at priority 274.Dq info 275every 20 minutes 276(see 277.Xr syslogd 8 ) . 278This is not enabled by a 279.Em facility 280field containing an asterisk. 281.Pp 282The special 283.Em level 284.Dq none 285disables a particular 286.Em facility . 287.Pp 288The 289.Em action 290field of each line specifies the action to be taken when the 291.Em selector 292field selects a message. 293There are five forms: 294.Bl -bullet 295.It 296A pathname (beginning with a leading slash). 297Selected messages are appended to the file. 298.It 299A hostname (preceded by an at 300.Pq Dq @ 301sign). 302Selected messages are forwarded to the 303.Xr syslogd 8 304program on the named host. 305.It 306A comma separated list of users. 307Selected messages are written to those users 308if they are logged in. 309.It 310An asterisk. 311Selected messages are written to all logged-in users. 312.It 313A vertical bar 314.Pq Dq \&| , 315followed by a command to pipe the selected 316messages to. The command is passed to 317.Xr sh 1 318for evaluation, so usual shell metacharacters or input/output 319redirection can occur. (Note however that redirecting 320.Xr stdio 3 321buffered output from the invoked command can cause additional delays, 322or even lost output data in case a logging subprocess exited with a 323signal.) The command itself runs with 324.Em stdout 325and 326.Em stderr 327redirected to 328.Pa /dev/null . 329Upon receipt of a 330.Dv SIGHUP , 331.Xr syslogd 8 332will close the pipe to the process. If the process didn't exit 333voluntarily, it will be sent a 334.Dv SIGTERM 335signal after a grace period of up to 60 seconds. 336.Pp 337The command will only be started once data arrives that should be piped 338to it. If it exited later, it will be restarted as necessary. So if it 339is desired that the subprocess should get exactly one line of input only 340(which can be very resource-consuming if there are a lot of messages 341flowing quickly), this can be achieved by exiting after just one line of 342input. If necessary, a script wrapper can be written to this effect. 343.Pp 344Unless the command is a full pipeline, it's probably useful to 345start the command with 346.Em exec 347so that the invoking shell process does not wait for the command to 348complete. Warning: the process is started under the UID invoking 349.Xr syslogd 8 , 350normally the superuser. 351.El 352.Pp 353Blank lines and lines whose first non-blank character is a hash 354.Pq Dq # 355character are ignored. 356.Sh EXAMPLES 357A configuration file might appear as follows: 358.Bd -literal 359# Log all kernel messages, authentication messages of 360# level notice or higher and anything of level err or 361# higher to the console. 362# Don't log private authentication messages! 363*.err;kern.*;auth.notice;authpriv.none /dev/console 364 365# Log anything (except mail) of level info or higher. 366# Don't log private authentication messages! 367*.info;mail.none;authpriv.none /var/log/messages 368 369# Log daemon messages at debug level only 370daemon.=debug /var/log/daemon.debug 371 372# The authpriv file has restricted access. 373authpriv.* /var/log/secure 374 375# Log all the mail messages in one place. 376mail.* /var/log/maillog 377 378# Everybody gets emergency messages, plus log them on another 379# machine. 380*.emerg * 381*.emerg @arpa.berkeley.edu 382 383# Root and Eric get alert and higher messages. 384*.alert root,eric 385 386# Save mail and news errors of level err and higher in a 387# special file. 388uucp,news.crit /var/log/spoolerr 389 390# Pipe all authentication messages to a filter. 391auth.* |exec /usr/local/sbin/authfilter 392 393# Save ftpd transactions along with mail and news 394!ftpd 395*.* /var/log/spoolerr 396 397# Log all security messages to a separate file. 398security.* /var/log/security 399 400# Log all writes to /dev/console to a separate file. 401console.* /var/log/console.log 402.Ed 403.Sh IMPLEMENTATION NOTES 404The 405.Dq kern 406facility is usually reserved for messages 407generated by the local kernel. 408Other messages logged with facility 409.Dq kern 410are usually translated to facility 411.Dq user . 412This translation can be disabled, 413see 414.Xr syslogd 8 415for details. 416.Sh FILES 417.Bl -tag -width /etc/syslog.conf -compact 418.It Pa /etc/syslog.conf 419.Xr syslogd 8 420configuration file 421.El 422.Sh BUGS 423The effects of multiple 424.Em selectors 425are sometimes not intuitive. 426For example 427.Dq mail.crit,*.err 428will select 429.Dq mail 430facility messages at the level of 431.Dq err 432or higher, not at the level of 433.Dq crit 434or higher. 435.Pp 436In networked environments, note that not all operating systems 437implement the same set of facilities. The facilities 438authpriv, cron, ftp, and ntp that are known to this implementation 439might be absent on the target system. Even worse, DEC UNIX uses 440facility number 10 (which is authpriv in this implementation) to 441log events for their AdvFS filesystem. 442.Sh SEE ALSO 443.Xr syslog 3 , 444.Xr syslogd 8 445