1.\" Copyright (c) 1983, 1986, 1991, 1993 2.\" The Regents of the University of California. All rights reserved. 3.\" 4.\" Redistribution and use in source and binary forms, with or without 5.\" modification, are permitted provided that the following conditions 6.\" are met: 7.\" 1. Redistributions of source code must retain the above copyright 8.\" notice, this list of conditions and the following disclaimer. 9.\" 2. Redistributions in binary form must reproduce the above copyright 10.\" notice, this list of conditions and the following disclaimer in the 11.\" documentation and/or other materials provided with the distribution. 12.\" 3. Neither the name of the University nor the names of its contributors 13.\" may be used to endorse or promote products derived from this software 14.\" without specific prior written permission. 15.\" 16.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 17.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 20.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 21.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 22.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 23.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 24.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 25.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26.\" SUCH DAMAGE. 27.\" 28.\" @(#)syslogd.8 8.1 (Berkeley) 6/6/93 29.\" $FreeBSD$ 30.\" 31.Dd July 2, 2018 32.Dt SYSLOGD 8 33.Os 34.Sh NAME 35.Nm syslogd 36.Nd log systems messages 37.Sh SYNOPSIS 38.Nm 39.Op Fl 468ACcdFHkNnosTuv 40.Op Fl a Ar allowed_peer 41.Op Fl b Ar bind_address 42.Op Fl f Ar config_file 43.Op Fl l Oo Ar mode Ns \&: Oc Ns Ar path 44.Op Fl m Ar mark_interval 45.Op Fl O Ar format 46.Op Fl P Ar pid_file 47.Op Fl p Ar log_socket 48.Op Fl S Ar logpriv_socket 49.Sh DESCRIPTION 50The 51.Nm 52utility reads and logs messages to the system console, 53log files, 54other 55machines and/or users as specified by its configuration file. 56.Pp 57The options are as follows: 58.Bl -tag -width indent 59.It Fl 4 60Force 61.Nm 62to use IPv4 addresses only. 63.It Fl 6 64Force 65.Nm 66to use IPv6 addresses only. 67.It Fl 8 68Tells 69.Nm 70not to interfere with 8-bit data. 71Normally 72.Nm 73will replace C1 control characters 74.Pq ISO 8859 and Unicode characters 75with their 76.Dq M- Ns Em x 77equivalent. 78Note, this option does not change the way 79.Nm 80alters control characters 81.Pq see Xr iscntrl 3 . 82They will always be replaced with their 83.Dq ^ Ns Em x 84equivalent. 85.It Fl A 86Ordinarily, 87.Nm 88tries to send the message to only one address 89even if the host has more than one A or AAAA record. 90If this option is specified, 91.Nm 92tries to send the message to all addresses. 93.It Fl a Ar allowed_peer 94Allow 95.Ar allowed_peer 96to log to this 97.Nm 98using UDP datagrams. 99Multiple 100.Fl a 101options may be specified. 102.Pp 103The 104.Ar allowed_peer 105option may be any of the following: 106.Bl -tag -width "ipaddr[/prefixlen][:service]XX" 107.It Xo 108.Sm off 109.Ar ipaddr 110.Op / Ar masklen 111.Op \&: Ar service 112.Pp 113.Ar ipaddr 114.Op / Ar prefixlen 115.Op \&: Ar service 116.Sm on 117.Xc 118Accept datagrams from 119.Ar ipaddr , 120.Ar ipaddr 121can be specified as an IPv4 address or as an IPv6 122address enclosed with 123.Ql \&[ 124and 125.Ql \&] . 126If specified, 127.Ar service 128is the name or number of an UDP service (see 129.Xr services 5 ) 130the source packet must belong to. 131A 132.Ar service 133of 134.Ql \&* 135accepts UDP packets from any source port. 136The default 137.Ar service 138is 139.Ql syslog . 140If 141.Ar ipaddr 142is IPv4 address, a missing 143.Ar masklen 144will be substituted by the historic class A or class B netmasks if 145.Ar ipaddr 146belongs into the address range of class A or B, 147respectively, 148or by 24 otherwise. 149If 150.Ar ipaddr 151is IPv6 address, 152a missing 153.Ar masklen 154will be substituted by 128. 155.It Xo 156.Sm off 157.Ar domainname Op \&: Ar service 158.Sm on 159.Xc 160Accept datagrams where the reverse address lookup yields 161.Ar domainname 162for the sender address. 163The meaning of 164.Ar service 165is as explained above. 166.Ar domainname 167can contain special characters of a shell-style pattern such as 168.Ql Li \&* . 169.El 170.Pp 171The 172.Fl a 173options are ignored if the 174.Fl s 175option is also specified. 176.It Xo 177.Fl b 178.Sm off 179.Ar bind_address Op \&: Ar service 180.Sm on 181.Xc 182.It Xo 183.Fl b 184.Sm off 185.Li \&: Ar service 186.Sm on 187.Xc 188Bind to a specific address and/or port. 189The address can be specified as a hostname, 190and the port as a service name. 191If an IPv6 address is specified, it should be enclosed with 192.Ql \&[ 193and 194.Ql \&] . 195The default 196.Ar service 197is 198.Ql syslog . 199This option can be specified multiple times to bind to 200multiple addresses and/or ports. 201.It Fl C 202Create log files that do not exist 203.Pq permission is set to Ql Li 0600 . 204.It Fl c 205Disable the compression of repeated instances of the same line 206into a single line of the form 207.Dq Li "last message repeated N times" 208when the output is a pipe to another program. 209If specified twice, 210disable this compression in all cases. 211.It Fl d 212Put 213.Nm 214into debugging mode. 215This is probably only of use to developers working on 216.Nm . 217.It Fl f Ar config_file 218Specify the pathname of an alternate configuration file; 219the default is 220.Pa /etc/syslog.conf . 221.It Fl F 222Run 223.Nm 224in the foreground, 225rather than going into daemon mode. 226This is useful if some other process uses 227.Xr fork 2 228and 229.Xr exec 3 230to run 231.Nm , 232and wants to monitor when and how it exits. 233.It Fl H 234When logging remote messages use hostname from the message (if supplied) 235instead of using address from which the message was received. 236.It Fl k 237Disable the translation of 238messages received with facility 239.Dq kern 240to facility 241.Dq user . 242Usually the 243.Dq kern 244facility is reserved for messages read directly from 245.Pa /dev/klog . 246.It Fl m Ar mark_interval 247Select the number of minutes between 248.Dq mark 249messages; 250the default is 20 minutes. 251.It Fl N 252Disable binding on UDP sockets. 253RFC 3164 recommends that outgoing 254.Nm 255messages should originate from the privileged port, 256this option 257.Em disables 258the recommended behavior. 259This option inherits 260.Fl s . 261.It Fl n 262Disable DNS query for every request. 263.It Fl O Ar format 264Select the output format of generated log messages. 265The values 266.Ar bsd 267and 268.Ar rfc3164 269are used to generate RFC 3164 log messages. 270The values 271.Ar syslog 272and 273.Ar rfc5424 274are used to generate RFC 5424 log messages, 275having RFC 3339 timestamps with microsecond precision. 276The default is to generate RFC 3164 log messages. 277.It Fl o 278Prefix kernel messages with the full kernel boot file as determined by 279.Xr getbootfile 3 . 280Without this, the kernel message prefix is always 281.Dq Li kernel: . 282.It Fl p Ar log_socket 283Specify the pathname of an alternate log socket to be used instead; 284the default is 285.Pa /var/run/log . 286When a single 287.Fl p 288option is specified, 289the default pathname is replaced with the specified one. 290When two or more 291.Fl p 292options are specified, 293the remaining pathnames are treated as additional log sockets. 294.It Fl P Ar pid_file 295Specify an alternative file in which to store the process ID. 296The default is 297.Pa /var/run/syslog.pid . 298.It Fl S Ar logpriv_socket 299Specify the pathname of an alternate log socket for privileged 300applications to be used instead; 301the default is 302.Pa /var/run/logpriv . 303When a single 304.Fl S 305option is specified, 306the default pathname is replaced with the specified one. 307When two or more 308.Fl S 309options are specified, 310the remaining pathnames are treated as additional log sockets. 311.It Fl l Oo Ar mode Ns \&: Oc Ns Ar path 312Specify a location where 313.Nm 314should place an additional log socket. 315The primary use for this is to place additional log sockets in 316.Pa /var/run/log 317of various chroot filespaces. 318File permissions for socket can be specified in octal representation in 319.Ar mode , 320delimited with a colon. 321The socket location must be specified as an absolute pathname in 322.Ar path . 323.It Fl s 324Operate in secure mode. 325Do not log messages from remote machines. 326If specified twice, 327no network socket will be opened at all, 328which also disables logging to remote machines. 329.It Fl T 330Always use the local time and date for messages received from the network, 331instead of the timestamp field supplied in the message by the remote host. 332This is useful if some of the originating hosts cannot keep time properly 333or are unable to generate a correct timestamp. 334.It Fl u 335Unique priority logging. 336Only log messages at the specified priority. 337Without this option, 338messages at the stated priority or higher are logged. 339This option changes the default comparison from 340.Dq => 341to 342.Dq = . 343.It Fl v 344Verbose logging. 345If specified once, 346the numeric facility and priority are 347logged with each locally-written message. 348If specified more than once, 349the names of the facility and priority are logged with each locally-written 350message. 351.Pp 352This option only affects the formatting of RFC 3164 messages. 353Messages formatted according to RFC 5424 always include a 354facility/priority number. 355.El 356.Pp 357The 358.Nm 359utility reads its configuration file when it starts up and whenever it 360receives a hangup signal. 361For information on the format of the configuration file, 362see 363.Xr syslog.conf 5 . 364.Pp 365The 366.Nm 367utility reads messages from the 368.Ux 369domain sockets 370.Pa /var/run/log 371and 372.Pa /var/run/logpriv , 373from an Internet domain socket specified in 374.Pa /etc/services , 375and from the special device 376.Pa /dev/klog 377.Pq to read kernel messages . 378.Pp 379The 380.Nm 381utility creates its process ID file, 382by default 383.Pa /var/run/syslog.pid , 384and stores its process 385ID there. 386This can be used to kill or reconfigure 387.Nm . 388.Pp 389The message sent to 390.Nm 391should consist of a single line. 392The message can contain a priority code, 393which should be a preceding 394decimal number in angle braces, 395for example, 396.Sq Aq 5 . 397This priority code should map into the priorities defined in the 398include file 399.In sys/syslog.h . 400.Pp 401For security reasons, 402.Nm 403will not append to log files that do not exist 404.Po unless Fl C 405option is specified 406.Pc ; 407therefore, they must be created manually before running 408.Nm . 409.Pp 410The date and time are taken from the received message. 411If the format of the timestamp field is incorrect, 412time obtained from the local host is used instead. 413This can be overridden by the 414.Fl T 415flag. 416.Sh FILES 417.Bl -tag -width /var/run/syslog.pid -compact 418.It Pa /etc/syslog.conf 419configuration file 420.It Pa /var/run/syslog.pid 421default process ID file 422.It Pa /var/run/log 423name of the 424.Ux 425domain datagram log socket 426.It Pa /var/run/logpriv 427.Ux 428socket for privileged applications 429.It Pa /dev/klog 430kernel log device 431.El 432.Sh SEE ALSO 433.Xr logger 1 , 434.Xr syslog 3 , 435.Xr services 5 , 436.Xr syslog.conf 5 , 437.Xr newsyslog 8 438.Sh HISTORY 439The 440.Nm 441utility appeared in 442.Bx 4.3 . 443.Pp 444The 445.Fl a , 446.Fl s , 447.Fl u , 448and 449.Fl v 450options are 451.Fx 2.2 452extensions. 453.Sh BUGS 454The ability to log messages received in UDP packets is equivalent to 455an unauthenticated remote disk-filling service, 456and should probably be disabled by default. 457Some sort of 458.No inter- Ns Nm syslogd 459authentication mechanism ought to be worked out. 460To prevent the worst abuse, 461use of the 462.Fl a 463option is therefore highly recommended. 464.Pp 465The 466.Fl a 467matching algorithm does not pretend to be very efficient; 468use of numeric IP addresses is faster than domain name comparison. 469Since the allowed peer list is being walked linearly, 470peer groups where frequent messages are being anticipated 471from should be put early into the 472.Fl a 473list. 474.Pp 475The log socket was moved from 476.Pa /dev 477to ease the use of a read-only root file system. 478This may confuse 479some old binaries so that a symbolic link might be used for a 480transitional period. 481