1.\" Copyright (c) 1983, 1986, 1991, 1993 2.\" The Regents of the University of California. All rights reserved. 3.\" 4.\" Redistribution and use in source and binary forms, with or without 5.\" modification, are permitted provided that the following conditions 6.\" are met: 7.\" 1. Redistributions of source code must retain the above copyright 8.\" notice, this list of conditions and the following disclaimer. 9.\" 2. Redistributions in binary form must reproduce the above copyright 10.\" notice, this list of conditions and the following disclaimer in the 11.\" documentation and/or other materials provided with the distribution. 12.\" 4. Neither the name of the University nor the names of its contributors 13.\" may be used to endorse or promote products derived from this software 14.\" without specific prior written permission. 15.\" 16.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 17.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 20.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 21.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 22.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 23.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 24.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 25.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26.\" SUCH DAMAGE. 27.\" 28.\" @(#)syslogd.8 8.1 (Berkeley) 6/6/93 29.\" $FreeBSD$ 30.\" 31.Dd June 16, 2015 32.Dt SYSLOGD 8 33.Os 34.Sh NAME 35.Nm syslogd 36.Nd log systems messages 37.Sh SYNOPSIS 38.Nm 39.Op Fl 468ACcdFkNnosTuv 40.Op Fl a Ar allowed_peer 41.Op Fl b Ar bind_address 42.Op Fl f Ar config_file 43.Op Fl l Oo Ar mode : Oc Ns Ar path 44.Op Fl m Ar mark_interval 45.Op Fl P Ar pid_file 46.Op Fl p Ar log_socket 47.Sh DESCRIPTION 48The 49.Nm 50utility reads and logs messages to the system console, log files, other 51machines and/or users as specified by its configuration file. 52.Pp 53The options are as follows: 54.Bl -tag -width indent 55.It Fl 4 56Force 57.Nm 58to use IPv4 addresses only. 59.It Fl 6 60Force 61.Nm 62to use IPv6 addresses only. 63.It Fl 8 64Tells 65.Nm 66not to interfere with 8-bit data. Normally 67.Nm 68will replace C1 control characters 69.Pq ISO 8859 and Unicode characters 70with their 71.Dq M- Ns Em x 72equivalent. 73Note, this option does not change the way 74.Nm 75alters control characters 76.Pq see Xr iscntrl 3 . 77They will always be replaced with their 78.Dq ^ Ns Em x 79equivalent. 80.It Fl A 81Ordinarily, 82.Nm 83tries to send the message to only one address 84even if the host has more than one A or AAAA record. 85If this option is specified, 86.Nm 87tries to send the message to all addresses. 88.It Fl a Ar allowed_peer 89Allow 90.Ar allowed_peer 91to log to this 92.Nm 93using UDP datagrams. 94Multiple 95.Fl a 96options may be specified. 97.Pp 98The 99.Ar allowed_peer 100option may be any of the following: 101.Bl -tag -width "ipaddr/masklen[:service]XX" 102.It Xo 103.Sm off 104.Ar ipaddr 105.No / Ar masklen 106.Op : Ar service 107.Sm on 108.Xc 109Accept datagrams from 110.Ar ipaddr 111(in the usual dotted quad notation) with 112.Ar masklen 113bits being taken into account when doing the address comparison. 114.Ar ipaddr 115can be also IPv6 address by enclosing the address with 116.Ql \&[ 117and 118.Ql \&] . 119If specified, 120.Ar service 121is the name or number of an UDP service (see 122.Xr services 5 ) 123the source packet must belong to. 124A 125.Ar service 126of 127.Ql \&* 128allows packets being sent from any UDP port. 129The default 130.Ar service 131is 132.Ql syslog . 133If 134.Ar ipaddr 135is IPv4 address, a missing 136.Ar masklen 137will be substituted by the historic class A or class B netmasks if 138.Ar ipaddr 139belongs into the address range of class A or B, respectively, or 140by 24 otherwise. 141If 142.Ar ipaddr 143is IPv6 address, a missing 144.Ar masklen 145will be substituted by 128. 146.It Xo 147.Sm off 148.Ar domainname Op : Ar service 149.Sm on 150.Xc 151Accept datagrams where the reverse address lookup yields 152.Ar domainname 153for the sender address. 154The meaning of 155.Ar service 156is as explained above. 157.It Xo 158.Sm off 159.No * Ar domainname Op : Ar service 160.Sm on 161.Xc 162Same as before, except that any source host whose name 163.Em ends 164in 165.Ar domainname 166will get permission. 167.El 168.Pp 169The 170.Fl a 171options are ignored if the 172.Fl s 173option is also specified. 174.It Xo 175.Fl b 176.Sm off 177.Ar bind_address Op : Ar service 178.Sm on 179.Xc 180.It Xo 181.Fl b 182.Sm off 183.Li : Ar service 184.Sm on 185.Xc 186Bind to a specific address and/or port. 187The address can be specified as a hostname, 188and the port as a service name. 189If an IPv6 address is specified, it should be enclosed with 190.Ql \&[ 191and 192.Ql \&] . 193The default 194.Ar service 195is 196.Ql syslog . 197This option can be specified multiple times to bind to 198multiple addresses and/or ports. 199.It Fl C 200Create log files that do not exist (permission is set to 201.Li 0600 ) . 202.It Fl c 203Disable the compression of repeated instances of the same line 204into a single line of the form 205.Dq Li "last message repeated N times" 206when the output is a pipe to another program. 207If specified twice, disable this compression in all cases. 208.It Fl d 209Put 210.Nm 211into debugging mode. 212This is probably only of use to developers working on 213.Nm . 214.It Fl f 215Specify the pathname of an alternate configuration file; 216the default is 217.Pa /etc/syslog.conf . 218.It Fl F 219Run 220.Nm 221in the foreground, rather than going into daemon mode. This is useful if 222some other process uses 223.Xr fork 2 224and 225.Xr exec 3 226to run 227.Nm , 228and wants to monitor when and how it exits. 229.It Fl k 230Disable the translation of 231messages received with facility 232.Dq kern 233to facility 234.Dq user . 235Usually the 236.Dq kern 237facility is reserved for messages read directly from 238.Pa /dev/klog . 239.It Fl m 240Select the number of minutes between 241.Dq mark 242messages; the default is 20 minutes. 243.It Fl N 244Disable binding on UDP sockets. RFC 3164 recommends that outgoing 245syslogd messages should originate from the privileged port, this 246option 247.Em disables 248the recommended behavior. This option inherits 249.Fl s . 250.It Fl n 251Disable dns query for every request. 252.It Fl o 253Prefix kernel messages with the full kernel boot file as determined by 254.Xr getbootfile 3 . 255Without this, the kernel message prefix is always 256.Dq Li kernel: . 257.It Fl p 258Specify the pathname of an alternate log socket to be used instead; 259the default is 260.Pa /var/run/log . 261.It Fl P 262Specify an alternative file in which to store the process ID. 263The default is 264.Pa /var/run/syslog.pid . 265.It Fl S 266Specify the pathname of an alternate log socket for privileged 267applications to be used instead; the default is 268.Pa /var/run/logpriv . 269.It Fl l 270Specify a location where 271.Nm 272should place an additional log socket. 273The primary use for this is to place additional log sockets in 274.Pa /var/run/log 275of various chroot filespaces. 276File permissions for socket can be specified in octal representation 277before socket name, delimited with a colon. 278Path to socket location must be absolute. 279.It Fl s 280Operate in secure mode. 281Do not log messages from remote machines. 282If 283specified twice, no network socket will be opened at all, which also 284disables logging to remote machines. 285.It Fl T 286Always use the local time and date for messages received from the network, 287instead of the timestamp field supplied in the message by the remote host. 288This is useful if some of the originating hosts can't keep time properly 289or are unable to generate a correct timestamp. 290.It Fl u 291Unique priority logging. 292Only log messages at the specified priority. 293Without this option, messages at the stated priority or higher are logged. 294This option changes the default comparison from 295.Dq => 296to 297.Dq = . 298.It Fl v 299Verbose logging. 300If specified once, the numeric facility and priority are 301logged with each locally-written message. 302If specified more than once, 303the names of the facility and priority are logged with each locally-written 304message. 305.El 306.Pp 307The 308.Nm 309utility reads its configuration file when it starts up and whenever it 310receives a hangup signal. 311For information on the format of the configuration file, 312see 313.Xr syslog.conf 5 . 314.Pp 315The 316.Nm 317utility reads messages from the 318.Ux 319domain sockets 320.Pa /var/run/log 321and 322.Pa /var/run/logpriv , 323from an Internet domain socket specified in 324.Pa /etc/services , 325and from the special device 326.Pa /dev/klog 327(to read kernel messages). 328.Pp 329The 330.Nm 331utility creates its process ID file, 332by default 333.Pa /var/run/syslog.pid , 334and stores its process 335ID there. 336This can be used to kill or reconfigure 337.Nm . 338.Pp 339The message sent to 340.Nm 341should consist of a single line. 342The message can contain a priority code, which should be a preceding 343decimal number in angle braces, for example, 344.Sq Aq 5 . 345This priority code should map into the priorities defined in the 346include file 347.In sys/syslog.h . 348.Pp 349For security reasons, 350.Nm 351will not append to log files that do not exist (unless 352.Fl C 353option is specified); 354therefore, they must be created manually before running 355.Nm . 356.Pp 357The date and time are taken from the received message. 358If the format of the timestamp field is incorrect, 359time obtained from the local host is used instead. 360This can be overridden by the 361.Fl T 362flag. 363.Sh FILES 364.Bl -tag -width /var/run/syslog.pid -compact 365.It Pa /etc/syslog.conf 366configuration file 367.It Pa /var/run/syslog.pid 368default process ID file 369.It Pa /var/run/log 370name of the 371.Ux 372domain datagram log socket 373.It Pa /var/run/logpriv 374.Ux 375socket for privileged applications 376.It Pa /dev/klog 377kernel log device 378.El 379.Sh SEE ALSO 380.Xr logger 1 , 381.Xr syslog 3 , 382.Xr services 5 , 383.Xr syslog.conf 5 , 384.Xr newsyslog 8 385.Sh HISTORY 386The 387.Nm 388utility appeared in 389.Bx 4.3 . 390.Pp 391The 392.Fl a , 393.Fl s , 394.Fl u , 395and 396.Fl v 397options are 398.Fx 2.2 399extensions. 400.Sh BUGS 401The ability to log messages received in UDP packets is equivalent to 402an unauthenticated remote disk-filling service, and should probably be 403disabled by default. 404Some sort of 405.No inter- Ns Nm syslogd 406authentication mechanism ought to be worked out. 407To prevent the worst 408abuse, use of the 409.Fl a 410option is therefore highly recommended. 411.Pp 412The 413.Fl a 414matching algorithm does not pretend to be very efficient; use of numeric 415IP addresses is faster than domain name comparison. 416Since the allowed 417peer list is being walked linearly, peer groups where frequent messages 418are being anticipated from should be put early into the 419.Fl a 420list. 421.Pp 422The log socket was moved from 423.Pa /dev 424to ease the use of a read-only root file system. 425This may confuse 426some old binaries so that a symbolic link might be used for a 427transitional period. 428