1.\" Copyright (c) 1983, 1986, 1991, 1993 2.\" The Regents of the University of California. All rights reserved. 3.\" 4.\" Redistribution and use in source and binary forms, with or without 5.\" modification, are permitted provided that the following conditions 6.\" are met: 7.\" 1. Redistributions of source code must retain the above copyright 8.\" notice, this list of conditions and the following disclaimer. 9.\" 2. Redistributions in binary form must reproduce the above copyright 10.\" notice, this list of conditions and the following disclaimer in the 11.\" documentation and/or other materials provided with the distribution. 12.\" 3. Neither the name of the University nor the names of its contributors 13.\" may be used to endorse or promote products derived from this software 14.\" without specific prior written permission. 15.\" 16.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 17.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 20.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 21.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 22.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 23.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 24.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 25.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26.\" SUCH DAMAGE. 27.\" 28.\" @(#)syslogd.8 8.1 (Berkeley) 6/6/93 29.\" $FreeBSD$ 30.\" 31.Dd April 15, 2018 32.Dt SYSLOGD 8 33.Os 34.Sh NAME 35.Nm syslogd 36.Nd log systems messages 37.Sh SYNOPSIS 38.Nm 39.Op Fl 468ACcdFHkNnosTuv 40.Op Fl a Ar allowed_peer 41.Op Fl b Ar bind_address 42.Op Fl f Ar config_file 43.Op Fl l Oo Ar mode Ns \&: Oc Ns Ar path 44.Op Fl m Ar mark_interval 45.Op Fl O Ar format 46.Op Fl P Ar pid_file 47.Op Fl p Ar log_socket 48.Op Fl S Ar logpriv_socket 49.Sh DESCRIPTION 50The 51.Nm 52utility reads and logs messages to the system console, 53log files, 54other 55machines and/or users as specified by its configuration file. 56.Pp 57The options are as follows: 58.Bl -tag -width indent 59.It Fl 4 60Force 61.Nm 62to use IPv4 addresses only. 63.It Fl 6 64Force 65.Nm 66to use IPv6 addresses only. 67.It Fl 8 68Tells 69.Nm 70not to interfere with 8-bit data. 71Normally 72.Nm 73will replace C1 control characters 74.Pq ISO 8859 and Unicode characters 75with their 76.Dq M- Ns Em x 77equivalent. 78Note, this option does not change the way 79.Nm 80alters control characters 81.Pq see Xr iscntrl 3 . 82They will always be replaced with their 83.Dq ^ Ns Em x 84equivalent. 85.It Fl A 86Ordinarily, 87.Nm 88tries to send the message to only one address 89even if the host has more than one A or AAAA record. 90If this option is specified, 91.Nm 92tries to send the message to all addresses. 93.It Fl a Ar allowed_peer 94Allow 95.Ar allowed_peer 96to log to this 97.Nm 98using UDP datagrams. 99Multiple 100.Fl a 101options may be specified. 102.Pp 103The 104.Ar allowed_peer 105option may be any of the following: 106.Bl -tag -width "ipaddr[/prefixlen][:service]XX" 107.It Xo 108.Sm off 109.Ar ipaddr 110.Op / Ar masklen 111.Op \&: Ar service 112.Pp 113.Ar ipaddr 114.Op / Ar prefixlen 115.Op \&: Ar service 116.Sm on 117.Xc 118Accept datagrams from 119.Ar ipaddr , 120.Ar ipaddr 121can be specified as an IPv4 address or as an IPv6 122address enclosed with 123.Ql \&[ 124and 125.Ql \&] . 126If specified, 127.Ar service 128is the name or number of an UDP service (see 129.Xr services 5 ) 130the source packet must belong to. 131A 132.Ar service 133of 134.Ql \&* 135accepts UDP packets from any source port. 136The default 137.Ar service 138is 139.Ql syslog . 140If 141.Ar ipaddr 142is IPv4 address, a missing 143.Ar masklen 144will be substituted by the historic class A or class B netmasks if 145.Ar ipaddr 146belongs into the address range of class A or B, 147respectively, 148or by 24 otherwise. 149If 150.Ar ipaddr 151is IPv6 address, 152a missing 153.Ar masklen 154will be substituted by 128. 155.It Xo 156.Sm off 157.Ar domainname Op \&: Ar service 158.Sm on 159.Xc 160Accept datagrams where the reverse address lookup yields 161.Ar domainname 162for the sender address. 163The meaning of 164.Ar service 165is as explained above. 166.Ar domainname 167can contain special characters of a shell-style pattern such as 168.Ql Li \&* . 169.El 170.Pp 171The 172.Fl a 173options are ignored if the 174.Fl s 175option is also specified. 176.It Xo 177.Fl b 178.Sm off 179.Ar bind_address Op \&: Ar service 180.Sm on 181.Xc 182.It Xo 183.Fl b 184.Sm off 185.Li \&: Ar service 186.Sm on 187.Xc 188Bind to a specific address and/or port. 189The address can be specified as a hostname, 190and the port as a service name. 191If an IPv6 address is specified, it should be enclosed with 192.Ql \&[ 193and 194.Ql \&] . 195The default 196.Ar service 197is 198.Ql syslog . 199This option can be specified multiple times to bind to 200multiple addresses and/or ports. 201.It Fl C 202Create log files that do not exist 203.Pq permission is set to Ql Li 0600 . 204.It Fl c 205Disable the compression of repeated instances of the same line 206into a single line of the form 207.Dq Li "last message repeated N times" 208when the output is a pipe to another program. 209If specified twice, 210disable this compression in all cases. 211.It Fl d 212Put 213.Nm 214into debugging mode. 215This is probably only of use to developers working on 216.Nm . 217.It Fl f Ar config_file 218Specify the pathname of an alternate configuration file; 219the default is 220.Pa /etc/syslog.conf . 221.It Fl F 222Run 223.Nm 224in the foreground, 225rather than going into daemon mode. 226This is useful if some other process uses 227.Xr fork 2 228and 229.Xr exec 3 230to run 231.Nm , 232and wants to monitor when and how it exits. 233.It Fl H 234When logging remote messages use hostname from the message (if supplied) 235instead of using address from which the message was received. 236.It Fl k 237Disable the translation of 238messages received with facility 239.Dq kern 240to facility 241.Dq user . 242Usually the 243.Dq kern 244facility is reserved for messages read directly from 245.Pa /dev/klog . 246.It Fl m Ar mark_interval 247Select the number of minutes between 248.Dq mark 249messages; 250the default is 20 minutes. 251.It Fl N 252Disable binding on UDP sockets. 253RFC 3164 recommends that outgoing 254.Nm 255messages should originate from the privileged port, 256this option 257.Em disables 258the recommended behavior. 259This option inherits 260.Fl s . 261.It Fl n 262Disable DNS query for every request. 263.It Fl O Ar format 264Select the output format of generated log messages. 265The values 266.Ar bsd 267and 268.Ar rfc3164 269are used to generate RFC 3164 log messages. 270The values 271.Ar syslog 272and 273.Ar rfc5424 274are used to generate RFC 5424 log messages, 275having RFC 3339 timestamps with microsecond precision. 276The default is to generate RFC 3164 log messages. 277.It Fl o 278Prefix kernel messages with the full kernel boot file as determined by 279.Xr getbootfile 3 . 280Without this, the kernel message prefix is always 281.Dq Li kernel: . 282.It Fl p Ar log_socket 283Specify the pathname of an alternate log socket to be used instead; 284the default is 285.Pa /var/run/log . 286When a single 287.Fl p 288option is specified, 289the default pathname is replaced with the specified one. 290When two or more 291.Fl p 292options are specified, 293the remaining pathnames are treated as additional log sockets. 294.It Fl P Ar pid_file 295Specify an alternative file in which to store the process ID. 296The default is 297.Pa /var/run/syslog.pid . 298.It Fl S Ar logpriv_socket 299Specify the pathname of an alternate log socket for privileged 300applications to be used instead; 301the default is 302.Pa /var/run/logpriv . 303When a single 304.Fl S 305option is specified, 306the default pathname is replaced with the specified one. 307When two or more 308.Fl S 309options are specified, 310the remaining pathnames are treated as additional log sockets. 311.It Fl l Oo Ar mode Ns \&: Oc Ns Ar path 312Specify a location where 313.Nm 314should place an additional log socket. 315The primary use for this is to place additional log sockets in 316.Pa /var/run/log 317of various chroot filespaces. 318File permissions for socket can be specified in octal representation in 319.Ar mode , 320delimited with a colon. 321The socket location must be specified as an absolute pathname in 322.Ar path . 323.It Fl s 324Operate in secure mode. 325Do not log messages from remote machines. 326If specified twice, 327no network socket will be opened at all, 328which also disables logging to remote machines. 329.It Fl T 330Always use the local time and date for messages received from the network, 331instead of the timestamp field supplied in the message by the remote host. 332This is useful if some of the originating hosts cannot keep time properly 333or are unable to generate a correct timestamp. 334.It Fl u 335Unique priority logging. 336Only log messages at the specified priority. 337Without this option, 338messages at the stated priority or higher are logged. 339This option changes the default comparison from 340.Dq => 341to 342.Dq = . 343.It Fl v 344Verbose logging. 345If specified once, 346the numeric facility and priority are 347logged with each locally-written message. 348If specified more than once, 349the names of the facility and priority are logged with each locally-written 350message. 351.El 352.Pp 353The 354.Nm 355utility reads its configuration file when it starts up and whenever it 356receives a hangup signal. 357For information on the format of the configuration file, 358see 359.Xr syslog.conf 5 . 360.Pp 361The 362.Nm 363utility reads messages from the 364.Ux 365domain sockets 366.Pa /var/run/log 367and 368.Pa /var/run/logpriv , 369from an Internet domain socket specified in 370.Pa /etc/services , 371and from the special device 372.Pa /dev/klog 373.Pq to read kernel messages . 374.Pp 375The 376.Nm 377utility creates its process ID file, 378by default 379.Pa /var/run/syslog.pid , 380and stores its process 381ID there. 382This can be used to kill or reconfigure 383.Nm . 384.Pp 385The message sent to 386.Nm 387should consist of a single line. 388The message can contain a priority code, 389which should be a preceding 390decimal number in angle braces, 391for example, 392.Sq Aq 5 . 393This priority code should map into the priorities defined in the 394include file 395.In sys/syslog.h . 396.Pp 397For security reasons, 398.Nm 399will not append to log files that do not exist 400.Po unless Fl C 401option is specified 402.Pc ; 403therefore, they must be created manually before running 404.Nm . 405.Pp 406The date and time are taken from the received message. 407If the format of the timestamp field is incorrect, 408time obtained from the local host is used instead. 409This can be overridden by the 410.Fl T 411flag. 412.Sh FILES 413.Bl -tag -width /var/run/syslog.pid -compact 414.It Pa /etc/syslog.conf 415configuration file 416.It Pa /var/run/syslog.pid 417default process ID file 418.It Pa /var/run/log 419name of the 420.Ux 421domain datagram log socket 422.It Pa /var/run/logpriv 423.Ux 424socket for privileged applications 425.It Pa /dev/klog 426kernel log device 427.El 428.Sh SEE ALSO 429.Xr logger 1 , 430.Xr syslog 3 , 431.Xr services 5 , 432.Xr syslog.conf 5 , 433.Xr newsyslog 8 434.Sh HISTORY 435The 436.Nm 437utility appeared in 438.Bx 4.3 . 439.Pp 440The 441.Fl a , 442.Fl s , 443.Fl u , 444and 445.Fl v 446options are 447.Fx 2.2 448extensions. 449.Sh BUGS 450The ability to log messages received in UDP packets is equivalent to 451an unauthenticated remote disk-filling service, 452and should probably be disabled by default. 453Some sort of 454.No inter- Ns Nm syslogd 455authentication mechanism ought to be worked out. 456To prevent the worst abuse, 457use of the 458.Fl a 459option is therefore highly recommended. 460.Pp 461The 462.Fl a 463matching algorithm does not pretend to be very efficient; 464use of numeric IP addresses is faster than domain name comparison. 465Since the allowed peer list is being walked linearly, 466peer groups where frequent messages are being anticipated 467from should be put early into the 468.Fl a 469list. 470.Pp 471The log socket was moved from 472.Pa /dev 473to ease the use of a read-only root file system. 474This may confuse 475some old binaries so that a symbolic link might be used for a 476transitional period. 477