1.\" Copyright (c) 1983, 1986, 1991, 1993 2.\" The Regents of the University of California. All rights reserved. 3.\" 4.\" Redistribution and use in source and binary forms, with or without 5.\" modification, are permitted provided that the following conditions 6.\" are met: 7.\" 1. Redistributions of source code must retain the above copyright 8.\" notice, this list of conditions and the following disclaimer. 9.\" 2. Redistributions in binary form must reproduce the above copyright 10.\" notice, this list of conditions and the following disclaimer in the 11.\" documentation and/or other materials provided with the distribution. 12.\" 4. Neither the name of the University nor the names of its contributors 13.\" may be used to endorse or promote products derived from this software 14.\" without specific prior written permission. 15.\" 16.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 17.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 20.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 21.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 22.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 23.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 24.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 25.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26.\" SUCH DAMAGE. 27.\" 28.\" @(#)syslogd.8 8.1 (Berkeley) 6/6/93 29.\" $FreeBSD$ 30.\" 31.Dd May 13, 2008 32.Dt SYSLOGD 8 33.Os 34.Sh NAME 35.Nm syslogd 36.Nd log systems messages 37.Sh SYNOPSIS 38.Nm 39.Op Fl 468ACcdknosuv 40.Op Fl a Ar allowed_peer 41.Op Fl b Ar bind_address 42.Op Fl f Ar config_file 43.Op Fl l Oo Ar mode : Oc Ns Ar path 44.Op Fl m Ar mark_interval 45.Op Fl P Ar pid_file 46.Op Fl p Ar log_socket 47.Sh DESCRIPTION 48The 49.Nm 50utility reads and logs messages to the system console, log files, other 51machines and/or users as specified by its configuration file. 52.Pp 53The options are as follows: 54.Bl -tag -width indent 55.It Fl 4 56Force 57.Nm 58to use IPv4 addresses only. 59.It Fl 6 60Force 61.Nm 62to use IPv6 addresses only. 63.It Fl 8 64Tells 65.Nm 66not to interfere with 8-bit data. Normally 67.Nm 68will replace C1 control characters 69.Pq ISO 8859 and Unicode characters 70with their 71.Dq M- Ns Em x 72equivalent. 73Note, this option does not change the way 74.Nm 75alters control characters 76.Pq see Xr iscntrl 3 . 77They will always be replaced with their 78.Dq ^ Ns Em x 79equivalent. 80.It Fl A 81Ordinarily, 82.Nm 83tries to send the message to only one address 84even if the host has more than one A or AAAA record. 85If this option is specified, 86.Nm 87tries to send the message to all addresses. 88.It Fl a Ar allowed_peer 89Allow 90.Ar allowed_peer 91to log to this 92.Nm 93using UDP datagrams. 94Multiple 95.Fl a 96options may be specified. 97.Pp 98.Ar Allowed_peer 99can be any of the following: 100.Bl -tag -width "ipaddr/masklen[:service]XX" 101.It Xo 102.Sm off 103.Ar ipaddr 104.No / Ar masklen 105.Op : Ar service 106.Sm on 107.Xc 108Accept datagrams from 109.Ar ipaddr 110(in the usual dotted quad notation) with 111.Ar masklen 112bits being taken into account when doing the address comparison. 113.Ar ipaddr 114can be also IPv6 address by enclosing the address with 115.Ql \&[ 116and 117.Ql \&] . 118If specified, 119.Ar service 120is the name or number of an UDP service (see 121.Xr services 5 ) 122the source packet must belong to. 123A 124.Ar service 125of 126.Ql \&* 127allows packets being sent from any UDP port. 128The default 129.Ar service 130is 131.Ql syslog . 132If 133.Ar ipaddr 134is IPv4 address, a missing 135.Ar masklen 136will be substituted by the historic class A or class B netmasks if 137.Ar ipaddr 138belongs into the address range of class A or B, respectively, or 139by 24 otherwise. 140If 141.Ar ipaddr 142is IPv6 address, a missing 143.Ar masklen 144will be substituted by 128. 145.It Xo 146.Sm off 147.Ar domainname Op : Ar service 148.Sm on 149.Xc 150Accept datagrams where the reverse address lookup yields 151.Ar domainname 152for the sender address. 153The meaning of 154.Ar service 155is as explained above. 156.It Xo 157.Sm off 158.No * Ar domainname Op : Ar service 159.Sm on 160.Xc 161Same as before, except that any source host whose name 162.Em ends 163in 164.Ar domainname 165will get permission. 166.El 167.Pp 168The 169.Fl a 170options are ignored if the 171.Fl s 172option is also specified. 173.It Fl b Ar bind_address 174Specify one specific IP address or hostname to bind to. 175If a hostname is specified, 176the IPv4 or IPv6 address which corresponds to it is used. 177.It Fl C 178Create log files that do not exist (permission is set to 179.Li 0600 ) . 180.It Fl c 181Disable the compression of repeated instances of the same line 182into a single line of the form 183.Dq Li "last message repeated N times" 184when the output is a pipe to another program. 185If specified twice, disable this compression in all cases. 186.It Fl d 187Put 188.Nm 189into debugging mode. 190This is probably only of use to developers working on 191.Nm . 192.It Fl f 193Specify the pathname of an alternate configuration file; 194the default is 195.Pa /etc/syslog.conf . 196.It Fl k 197Disable the translation of 198messages received with facility 199.Dq kern 200to facility 201.Dq user . 202Usually the 203.Dq kern 204facility is reserved for messages read directly from 205.Pa /dev/klog . 206.It Fl m 207Select the number of minutes between 208.Dq mark 209messages; the default is 20 minutes. 210.It Fl n 211Disable dns query for every request. 212.It Fl o 213Prefix kernel messages with the full kernel boot file as determined by 214.Xr getbootfile 3 . 215Without this, the kernel message prefix is always 216.Dq Li kernel: . 217.It Fl p 218Specify the pathname of an alternate log socket to be used instead; 219the default is 220.Pa /var/run/log . 221.It Fl P 222Specify an alternative file in which to store the process ID. 223The default is 224.Pa /var/run/syslog.pid . 225.It Fl S 226Specify the pathname of an alternate log socket for privileged 227applications to be used instead; the default is 228.Pa /var/run/logpriv . 229.It Fl l 230Specify a location where 231.Nm 232should place an additional log socket. 233The primary use for this is to place additional log sockets in 234.Pa /var/run/log 235of various chroot filespaces. 236File permissions for socket can be specified in octal representation 237before socket name, delimited with a colon. 238Path to socket location must be absolute. 239.It Fl s 240Operate in secure mode. 241Do not log messages from remote machines. 242If 243specified twice, no network socket will be opened at all, which also 244disables logging to remote machines. 245.It Fl T 246Always use the local time and date for messages received from the network, 247instead of the timestamp field supplied in the message by the remote host. 248This is useful if some of the originating hosts can't keep time properly 249or are unable to generate a correct timestamp. 250.It Fl u 251Unique priority logging. 252Only log messages at the specified priority. 253Without this option, messages at the stated priority or higher are logged. 254This option changes the default comparison from 255.Dq => 256to 257.Dq = . 258.It Fl v 259Verbose logging. 260If specified once, the numeric facility and priority are 261logged with each locally-written message. 262If specified more than once, 263the names of the facility and priority are logged with each locally-written 264message. 265.El 266.Pp 267The 268.Nm 269utility reads its configuration file when it starts up and whenever it 270receives a hangup signal. 271For information on the format of the configuration file, 272see 273.Xr syslog.conf 5 . 274.Pp 275The 276.Nm 277utility reads messages from the 278.Ux 279domain sockets 280.Pa /var/run/log 281and 282.Pa /var/run/logpriv , 283from an Internet domain socket specified in 284.Pa /etc/services , 285and from the special device 286.Pa /dev/klog 287(to read kernel messages). 288.Pp 289The 290.Nm 291utility creates its process ID file, 292by default 293.Pa /var/run/syslog.pid , 294and stores its process 295ID there. 296This can be used to kill or reconfigure 297.Nm . 298.Pp 299The message sent to 300.Nm 301should consist of a single line. 302The message can contain a priority code, which should be a preceding 303decimal number in angle braces, for example, 304.Sq Aq 5 . 305This priority code should map into the priorities defined in the 306include file 307.In sys/syslog.h . 308.Pp 309For security reasons, 310.Nm 311will not append to log files that do not exist (unless 312.Fl C 313option is specified); 314therefore, they must be created manually before running 315.Nm . 316.Pp 317The date and time are taken from the received message. 318If the format of the timestamp field is incorrect, 319time obtained from the local host is used instead. 320This can be overriden by the 321.Fl T 322flag. 323.Sh FILES 324.Bl -tag -width /var/run/syslog.pid -compact 325.It Pa /etc/syslog.conf 326configuration file 327.It Pa /var/run/syslog.pid 328default process ID file 329.It Pa /var/run/log 330name of the 331.Ux 332domain datagram log socket 333.It Pa /var/run/logpriv 334.Ux 335socket for privileged applications 336.It Pa /dev/klog 337kernel log device 338.El 339.Sh SEE ALSO 340.Xr logger 1 , 341.Xr syslog 3 , 342.Xr services 5 , 343.Xr syslog.conf 5 , 344.Xr newsyslog 8 345.Sh HISTORY 346The 347.Nm 348utility appeared in 349.Bx 4.3 . 350.Pp 351The 352.Fl a , 353.Fl s , 354.Fl u , 355and 356.Fl v 357options are 358.Fx 2.2 359extensions. 360.Sh BUGS 361The ability to log messages received in UDP packets is equivalent to 362an unauthenticated remote disk-filling service, and should probably be 363disabled by default. 364Some sort of 365.No inter- Ns Nm syslogd 366authentication mechanism ought to be worked out. 367To prevent the worst 368abuse, use of the 369.Fl a 370option is therefore highly recommended. 371.Pp 372The 373.Fl a 374matching algorithm does not pretend to be very efficient; use of numeric 375IP addresses is faster than domain name comparison. 376Since the allowed 377peer list is being walked linearly, peer groups where frequent messages 378are being anticipated from should be put early into the 379.Fl a 380list. 381.Pp 382The log socket was moved from 383.Pa /dev 384to ease the use of a read-only root file system. 385This may confuse 386some old binaries so that a symbolic link might be used for a 387transitional period. 388