1.\" Copyright (c) 1983, 1986, 1991, 1993 2.\" The Regents of the University of California. All rights reserved. 3.\" 4.\" Redistribution and use in source and binary forms, with or without 5.\" modification, are permitted provided that the following conditions 6.\" are met: 7.\" 1. Redistributions of source code must retain the above copyright 8.\" notice, this list of conditions and the following disclaimer. 9.\" 2. Redistributions in binary form must reproduce the above copyright 10.\" notice, this list of conditions and the following disclaimer in the 11.\" documentation and/or other materials provided with the distribution. 12.\" 4. Neither the name of the University nor the names of its contributors 13.\" may be used to endorse or promote products derived from this software 14.\" without specific prior written permission. 15.\" 16.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 17.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 20.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 21.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 22.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 23.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 24.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 25.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26.\" SUCH DAMAGE. 27.\" 28.\" @(#)syslogd.8 8.1 (Berkeley) 6/6/93 29.\" $FreeBSD$ 30.\" 31.Dd December 21, 2016 32.Dt SYSLOGD 8 33.Os 34.Sh NAME 35.Nm syslogd 36.Nd log systems messages 37.Sh SYNOPSIS 38.Nm 39.Op Fl 468ACcdFkNnosTuv 40.Op Fl a Ar allowed_peer 41.Op Fl b Ar bind_address 42.Op Fl f Ar config_file 43.Op Fl l Oo Ar mode Ns \&: Oc Ns Ar path 44.Op Fl m Ar mark_interval 45.Op Fl P Ar pid_file 46.Op Fl p Ar log_socket 47.Op Fl S Ar logpriv_socket 48.Sh DESCRIPTION 49The 50.Nm 51utility reads and logs messages to the system console, 52log files, 53other 54machines and/or users as specified by its configuration file. 55.Pp 56The options are as follows: 57.Bl -tag -width indent 58.It Fl 4 59Force 60.Nm 61to use IPv4 addresses only. 62.It Fl 6 63Force 64.Nm 65to use IPv6 addresses only. 66.It Fl 8 67Tells 68.Nm 69not to interfere with 8-bit data. 70Normally 71.Nm 72will replace C1 control characters 73.Pq ISO 8859 and Unicode characters 74with their 75.Dq M- Ns Em x 76equivalent. 77Note, this option does not change the way 78.Nm 79alters control characters 80.Pq see Xr iscntrl 3 . 81They will always be replaced with their 82.Dq ^ Ns Em x 83equivalent. 84.It Fl A 85Ordinarily, 86.Nm 87tries to send the message to only one address 88even if the host has more than one A or AAAA record. 89If this option is specified, 90.Nm 91tries to send the message to all addresses. 92.It Fl a Ar allowed_peer 93Allow 94.Ar allowed_peer 95to log to this 96.Nm 97using UDP datagrams. 98Multiple 99.Fl a 100options may be specified. 101.Pp 102The 103.Ar allowed_peer 104option may be any of the following: 105.Bl -tag -width "ipaddr/masklen[:service]XX" 106.It Xo 107.Sm off 108.Ar ipaddr 109.No / Ar masklen 110.Op \&: Ar service 111.Sm on 112.Xc 113Accept datagrams from 114.Ar ipaddr 115(in the usual dotted quad notation) with 116.Ar masklen 117bits being taken into account when doing the address comparison. 118.Ar ipaddr 119can be also IPv6 address by enclosing the address with 120.Ql \&[ 121and 122.Ql \&] . 123If specified, 124.Ar service 125is the name or number of an UDP service (see 126.Xr services 5 ) 127the source packet must belong to. 128A 129.Ar service 130of 131.Ql \&* 132allows packets being sent from any UDP port. 133The default 134.Ar service 135is 136.Ql syslog . 137If 138.Ar ipaddr 139is IPv4 address, a missing 140.Ar masklen 141will be substituted by the historic class A or class B netmasks if 142.Ar ipaddr 143belongs into the address range of class A or B, 144respectively, 145or by 24 otherwise. 146If 147.Ar ipaddr 148is IPv6 address, 149a missing 150.Ar masklen 151will be substituted by 128. 152.It Xo 153.Sm off 154.Ar domainname Op \&: Ar service 155.Sm on 156.Xc 157Accept datagrams where the reverse address lookup yields 158.Ar domainname 159for the sender address. 160The meaning of 161.Ar service 162is as explained above. 163.Ar domainname 164can contain special characters of a shell-style pattern such as 165.Ql Li \&* . 166.El 167.Pp 168The 169.Fl a 170options are ignored if the 171.Fl s 172option is also specified. 173.It Xo 174.Fl b 175.Sm off 176.Ar bind_address Op \&: Ar service 177.Sm on 178.Xc 179.It Xo 180.Fl b 181.Sm off 182.Li \&: Ar service 183.Sm on 184.Xc 185Bind to a specific address and/or port. 186The address can be specified as a hostname, 187and the port as a service name. 188If an IPv6 address is specified, it should be enclosed with 189.Ql \&[ 190and 191.Ql \&] . 192The default 193.Ar service 194is 195.Ql syslog . 196This option can be specified multiple times to bind to 197multiple addresses and/or ports. 198.It Fl C 199Create log files that do not exist 200.Pq permission is set to Ql Li 0600 . 201.It Fl c 202Disable the compression of repeated instances of the same line 203into a single line of the form 204.Dq Li "last message repeated N times" 205when the output is a pipe to another program. 206If specified twice, 207disable this compression in all cases. 208.It Fl d 209Put 210.Nm 211into debugging mode. 212This is probably only of use to developers working on 213.Nm . 214.It Fl f Ar config_file 215Specify the pathname of an alternate configuration file; 216the default is 217.Pa /etc/syslog.conf . 218.It Fl F 219Run 220.Nm 221in the foreground, 222rather than going into daemon mode. 223This is useful if some other process uses 224.Xr fork 2 225and 226.Xr exec 3 227to run 228.Nm , 229and wants to monitor when and how it exits. 230.It Fl k 231Disable the translation of 232messages received with facility 233.Dq kern 234to facility 235.Dq user . 236Usually the 237.Dq kern 238facility is reserved for messages read directly from 239.Pa /dev/klog . 240.It Fl m Ar mark_interval 241Select the number of minutes between 242.Dq mark 243messages; 244the default is 20 minutes. 245.It Fl N 246Disable binding on UDP sockets. 247RFC 3164 recommends that outgoing 248.Nm 249messages should originate from the privileged port, 250this option 251.Em disables 252the recommended behavior. 253This option inherits 254.Fl s . 255.It Fl n 256Disable DNS query for every request. 257.It Fl o 258Prefix kernel messages with the full kernel boot file as determined by 259.Xr getbootfile 3 . 260Without this, the kernel message prefix is always 261.Dq Li kernel: . 262.It Fl p Ar log_socket 263Specify the pathname of an alternate log socket to be used instead; 264the default is 265.Pa /var/run/log . 266When a single 267.Fl p 268options are specified, 269the default pathname is replaced with the specified one. 270When two or more 271.Fl p 272options are specified, 273the remaining pathnames are treated as additional log sockets. 274.It Fl P Ar pid_file 275Specify an alternative file in which to store the process ID. 276The default is 277.Pa /var/run/syslog.pid . 278.It Fl S Ar logpriv_socket 279Specify the pathname of an alternate log socket for privileged 280applications to be used instead; 281the default is 282.Pa /var/run/logpriv . 283When a single 284.Fl S 285options are specified, 286the default pathname is replaced with the specified one. 287When two or more 288.Fl S 289options are specified, 290the remaining pathnames are treated as additional log sockets. 291.It Fl l Oo Ar mode Ns \&: Oc Ns Ar path 292Specify a location where 293.Nm 294should place an additional log socket. 295The primary use for this is to place additional log sockets in 296.Pa /var/run/log 297of various chroot filespaces. 298File permissions for socket can be specified in octal representation in 299.Ar mode , 300delimited with a colon. 301The socket location must be specified as an absolute pathname in 302.Ar path . 303.It Fl s 304Operate in secure mode. 305Do not log messages from remote machines. 306If specified twice, 307no network socket will be opened at all, 308which also disables logging to remote machines. 309.It Fl T 310Always use the local time and date for messages received from the network, 311instead of the timestamp field supplied in the message by the remote host. 312This is useful if some of the originating hosts can't keep time properly 313or are unable to generate a correct timestamp. 314.It Fl u 315Unique priority logging. 316Only log messages at the specified priority. 317Without this option, 318messages at the stated priority or higher are logged. 319This option changes the default comparison from 320.Dq => 321to 322.Dq = . 323.It Fl v 324Verbose logging. 325If specified once, 326the numeric facility and priority are 327logged with each locally-written message. 328If specified more than once, 329the names of the facility and priority are logged with each locally-written 330message. 331.El 332.Pp 333The 334.Nm 335utility reads its configuration file when it starts up and whenever it 336receives a hangup signal. 337For information on the format of the configuration file, 338see 339.Xr syslog.conf 5 . 340.Pp 341The 342.Nm 343utility reads messages from the 344.Ux 345domain sockets 346.Pa /var/run/log 347and 348.Pa /var/run/logpriv , 349from an Internet domain socket specified in 350.Pa /etc/services , 351and from the special device 352.Pa /dev/klog 353.Pq to read kernel messages . 354.Pp 355The 356.Nm 357utility creates its process ID file, 358by default 359.Pa /var/run/syslog.pid , 360and stores its process 361ID there. 362This can be used to kill or reconfigure 363.Nm . 364.Pp 365The message sent to 366.Nm 367should consist of a single line. 368The message can contain a priority code, 369which should be a preceding 370decimal number in angle braces, 371for example, 372.Sq Aq 5 . 373This priority code should map into the priorities defined in the 374include file 375.In sys/syslog.h . 376.Pp 377For security reasons, 378.Nm 379will not append to log files that do not exist 380.Po unless Fl C 381option is specified 382.Pc ; 383therefore, they must be created manually before running 384.Nm . 385.Pp 386The date and time are taken from the received message. 387If the format of the timestamp field is incorrect, 388time obtained from the local host is used instead. 389This can be overridden by the 390.Fl T 391flag. 392.Sh FILES 393.Bl -tag -width /var/run/syslog.pid -compact 394.It Pa /etc/syslog.conf 395configuration file 396.It Pa /var/run/syslog.pid 397default process ID file 398.It Pa /var/run/log 399name of the 400.Ux 401domain datagram log socket 402.It Pa /var/run/logpriv 403.Ux 404socket for privileged applications 405.It Pa /dev/klog 406kernel log device 407.El 408.Sh SEE ALSO 409.Xr logger 1 , 410.Xr syslog 3 , 411.Xr services 5 , 412.Xr syslog.conf 5 , 413.Xr newsyslog 8 414.Sh HISTORY 415The 416.Nm 417utility appeared in 418.Bx 4.3 . 419.Pp 420The 421.Fl a , 422.Fl s , 423.Fl u , 424and 425.Fl v 426options are 427.Fx 2.2 428extensions. 429.Sh BUGS 430The ability to log messages received in UDP packets is equivalent to 431an unauthenticated remote disk-filling service, 432and should probably be disabled by default. 433Some sort of 434.No inter- Ns Nm syslogd 435authentication mechanism ought to be worked out. 436To prevent the worst abuse, 437use of the 438.Fl a 439option is therefore highly recommended. 440.Pp 441The 442.Fl a 443matching algorithm does not pretend to be very efficient; 444use of numeric IP addresses is faster than domain name comparison. 445Since the allowed peer list is being walked linearly, 446peer groups where frequent messages are being anticipated 447from should be put early into the 448.Fl a 449list. 450.Pp 451The log socket was moved from 452.Pa /dev 453to ease the use of a read-only root file system. 454This may confuse 455some old binaries so that a symbolic link might be used for a 456transitional period. 457