1.\" Copyright (c) 1983, 1986, 1991, 1993 2.\" The Regents of the University of California. All rights reserved. 3.\" 4.\" Redistribution and use in source and binary forms, with or without 5.\" modification, are permitted provided that the following conditions 6.\" are met: 7.\" 1. Redistributions of source code must retain the above copyright 8.\" notice, this list of conditions and the following disclaimer. 9.\" 2. Redistributions in binary form must reproduce the above copyright 10.\" notice, this list of conditions and the following disclaimer in the 11.\" documentation and/or other materials provided with the distribution. 12.\" 3. All advertising materials mentioning features or use of this software 13.\" must display the following acknowledgement: 14.\" This product includes software developed by the University of 15.\" California, Berkeley and its contributors. 16.\" 4. Neither the name of the University nor the names of its contributors 17.\" may be used to endorse or promote products derived from this software 18.\" without specific prior written permission. 19.\" 20.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 21.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 24.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 25.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 26.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 27.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 29.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 30.\" SUCH DAMAGE. 31.\" 32.\" @(#)syslogd.8 8.1 (Berkeley) 6/6/93 33.\" $FreeBSD$ 34.\" 35.Dd October 12, 1995 36.Dt SYSLOGD 8 37.Os BSD 4.2 38.Sh NAME 39.Nm syslogd 40.Nd log systems messages 41.Sh SYNOPSIS 42.Nm 43.Op Fl 46Adknsuv 44.Op Fl a Ar allowed_peer 45.Op Fl f Ar config_file 46.Op Fl m Ar mark_interval 47.Op Fl p Ar log_socket 48.Op Fl P Ar pid_file 49.Op Fl l Ar path 50.Sh DESCRIPTION 51The 52.Nm 53daemon reads and logs messages to the system console, log files, other 54machines and/or users as specified by its configuration file. 55.Pp 56The options are as follows: 57.Bl -tag -width indent 58.It Fl 4 59Forces 60.Nm 61to use IPv4 addresses only. 62.It Fl 6 63Forces 64.Nm 65to use IPv6 addresses only. 66.It Fl A 67.Nm 68tries to send the message to only one address 69even if the host has more than one A or AAAA record. 70If this option is specified, 71.Nm 72tries to send the message to all addresses. 73.It Fl a Ar allowed_peer 74Allow 75.Ar allowed_peer 76to log to this 77.Nm 78using UDP datagrams. Multiple 79.Fl a 80options may be specified. 81.Pp 82.Ar Allowed_peer 83can be any of the following: 84.Bl -tag -width "ipaddr/masklen[:service]XX" 85.It Xo 86.Sm off 87.Ar ipaddr 88.No / Ar masklen 89.Op : Ar service 90.Sm on 91.Xc 92Accept datagrams from 93.Ar ipaddr 94(in the usual dotted quad notation) with 95.Ar masklen 96bits being taken into account when doing the address comparison. 97.Ar ipaddr 98can be also IPv6 address by enclosing the address with 99.Ql \&[ 100and 101.Ql \&] . 102If specified, 103.Ar service 104is the name or number of an UDP service (see 105.Xr services 5 ) 106the source packet must belong to. A 107.Ar service 108of 109.Ql \&* 110allows packets being sent from any UDP port. The default 111.Ar service 112is 113.Ql syslog . 114If 115.Ar ipaddr 116is IPv4 address, a missing 117.Ar masklen 118will be substituted by the historic class A or class B netmasks if 119.Ar ipaddr 120belongs into the address range of class A or B, respectively, or 121by 24 otherwise. If 122.Ar ipaddr 123is IPv6 address, a missing 124.Ar masklen 125will be substituted by 128. 126.It Xo 127.Sm off 128.Ar domainname Op : Ar service 129.Sm on 130.Xc 131Accept datagrams where the reverse address lookup yields 132.Ar domainname 133for the sender address. The meaning of 134.Ar service 135is as explained above. 136.It Xo 137.Sm off 138.No * Ar domainname Op : Ar service 139.Sm on 140.Xc 141Same as before, except that any source host whose name 142.Em ends 143in 144.Ar domainname 145will get permission. 146.El 147.It Fl d 148Put 149.Nm 150into debugging mode. This is probably only of use to developers working on 151.Nm . 152.It Fl f 153Specify the pathname of an alternate configuration file; 154the default is 155.Pa /etc/syslog.conf . 156.It Fl k 157Disable the translation of 158messages received with facility 159.Dq kern 160to facility 161.Dq user . 162Usually the 163.Dq kern 164facility is reserved for messages read directly from 165.Pa /dev/klog . 166.It Fl m 167Select the number of minutes between 168.Dq mark 169messages; the default is 20 minutes. 170.It Fl n 171Disable dns query for every request. 172.It Fl p 173Specify the pathname of an alternate log socket to be used instead; 174the default is 175.Pa /var/run/log . 176.It Fl P 177Specify an alternative file in which to store the process ID. 178The default is 179.Pa /var/run/syslog.pid . 180.It Fl l 181Specify a location where 182.Nm 183should place an additional log socket. 184Up to 19 additional logging sockets can be specified. 185The primary use for this is to place additional log sockets in 186.Pa /var/run/log 187of various chroot filespaces. 188.It Fl s 189Operate in secure mode. Do not log messages from remote machines. If 190specified twice, no network socket will be opened at all, which also 191disables logging to remote machines. 192.It Fl u 193Unique priority logging. Only log messages at the specified priority. 194Without this option, messages at the stated priority or higher are logged. 195This option changes the default comparison from 196.Dq => 197to 198.Dq = . 199.It Fl v 200Verbose logging. If specified once, the numeric facility and priority are 201logged with each locally-written message. If specified more than once, 202the names of the facility and priority are logged with each locally-written 203message. 204.El 205.Pp 206The 207.Nm 208daemon reads its configuration file when it starts up and whenever it 209receives a hangup signal. 210For information on the format of the configuration file, 211see 212.Xr syslog.conf 5 . 213.Pp 214The 215.Nm 216daemon reads messages from the 217.Tn UNIX 218domain socket 219.Pa /var/run/log , 220from an Internet domain socket specified in 221.Pa /etc/services , 222and from the special device 223.Pa /dev/klog 224(to read kernel messages). 225.Pp 226The 227.Nm 228daemon creates its process ID file, 229by default 230.Pa /var/run/syslog.pid , 231and stores its process 232ID there. 233This can be used to kill or reconfigure 234.Nm . 235.Pp 236The message sent to 237.Nm 238should consist of a single line. 239The message can contain a priority code, which should be a preceding 240decimal number in angle braces, for example, 241.Sq Aq 5 . 242This priority code should map into the priorities defined in the 243include file 244.Aq Pa sys/syslog.h . 245.Sh FILES 246.Bl -tag -width /var/run/syslog.pid -compact 247.It Pa /etc/syslog.conf 248configuration file 249.It Pa /var/run/syslog.pid 250default process ID file 251.It Pa /var/run/log 252name of the 253.Tn UNIX 254domain datagram log socket 255.It Pa /dev/klog 256kernel log device 257.El 258.Sh SEE ALSO 259.Xr logger 1 , 260.Xr syslog 3 , 261.Xr services 5 , 262.Xr syslog.conf 5 263.Sh HISTORY 264The 265.Nm 266command appeared in 267.Bx 4.3 . 268.Pp 269The 270.Fl a , 271.Fl s , 272.Fl u , 273and 274.Fl v 275options are 276.Fx 2.2 277extensions. 278.Sh BUGS 279The ability to log messages received in UDP packets is equivalent to 280an unauthenticated remote disk-filling service, and should probably be 281disabled by default. Some sort of 282.No inter- Ns Nm syslogd 283authentication mechanism ought to be worked out. To prevent the worst 284abuse, use of the 285.Fl a 286option is therefore highly recommended. 287.Pp 288The 289.Fl a 290matching algorithm doesn't pretend to be very efficient; use of numeric 291IP addresses is faster than domain name comparison. Since the allowed 292peer list is being walked linearly, peer groups where frequent messages 293are being anticipated from should be put early into the 294.Fl a 295list. 296.Pp 297The log socket was moved from 298.Pa /dev 299to ease the use of a read-only root filesystem. 300This may confuse 301some old binaries so that a symbolic link might be used for a 302transitional period. 303