1 .\" Copyright (c) 1990, 1991, 1993
2 .\" The Regents of the University of California. All rights reserved.
4 .\" Redistribution and use in source and binary forms, with or without
5 .\" modification, are permitted provided that the following conditions
7 .\" 1. Redistributions of source code must retain the above copyright
8 .\" notice, this list of conditions and the following disclaimer.
9 .\" 2. Redistributions in binary form must reproduce the above copyright
10 .\" notice, this list of conditions and the following disclaimer in the
11 .\" documentation and/or other materials provided with the distribution.
12 .\" 3. All advertising materials mentioning features or use of this software
13 .\" must display the following acknowledgement:
14 .\" This product includes software developed by the University of
15 .\" California, Berkeley and its contributors.
16 .\" 4. Neither the name of the University nor the names of its contributors
17 .\" may be used to endorse or promote products derived from this software
18 .\" without specific prior written permission.
20 .\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
21 .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23 .\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
24 .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25 .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26 .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27 .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28 .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32 .\" @(#)syslog.conf.5 8.1 (Berkeley) 6/9/93
46 file is the configuration file for the
50 blocks of lines separated by
55 with each line containing two fields: the
57 field which specifies the types of messages and priorities to which the
60 field which specifies the action to be taken if a message
62 receives matches the selection criteria.
65 field is separated from the
67 field by one or more tab characters or spaces.
69 Note that if you use spaces as separators, your
71 might be incompatible with other Unices or Unix-like systems.
72 This functionality was added for the ease of configuration
73 (e.g. it is possible to cut-and-paste into
76 and to avoid possible mistakes.
77 This change however preserves
78 backwards compatibility with the old style of the
80 (i.e. tab characters only).
89 an optional set of comparison flags
93 with no intervening white-space.
102 describes the part of the system generating the message, and is one of
103 the following keywords: auth, authpriv, console, cron, daemon, ftp, kern,
104 lpr, mail, mark, news, ntp, security, syslog, user, uucp and local0 through
106 These keywords (with the exception of mark) correspond to the
109 values specified to the
117 may be used to specify exactly what is logged.
118 The default set of comparison flags are
122 which means that messages from the specified
125 level equal or greater than
131 describes the severity of the message, and is a keyword from the
132 following ordered list (higher to lower): emerg, alert, crit, err,
133 warning, notice, info and debug.
134 These keywords correspond to the
137 values specified to the
141 Each block of lines is separated from the previous block by a
146 A block will only log messages corresponding to the most recent
150 specifications given.
151 Thus, a block which selects
155 directly followed by a block that selects messages from the
158 then the second block will only log messages
165 specification is a line beginning with
169 (the former is for compatibility with the previous syslogd, if one is sharing
172 and the following blocks will be associated with calls to
174 from that specific program.
179 will also match any message logged by the kernel with the prefix
183 specification of the form
187 and the following blocks will be applied to messages
188 received from the specified hostname.
195 causes the following blocks to be applied to messages
196 from any host but the one specified.
197 If the hostname is given as
199 the local hostname will be used.
204 specification may be reset by giving the program or hostname as
209 for a further descriptions of both the
213 keywords and their significance.
214 It's preferred that selections be made on
218 since the latter can easily vary in a networked environment.
220 though, an appropriate
222 simply doesn't exist.
224 If a received message matches the specified
226 and is of the specified
228 .Em (or a higher level) ,
229 and the first word in the message after the date matches the
231 the action specified in the
237 may be specified for a single
239 by separating them with semicolon
242 It is important to note, however, that each
244 can modify the ones preceding it.
248 may be specified for a single
250 by separating them with comma
256 can be used to specify all
266 receives a message at priority
271 This is not enabled by a
273 field containing an asterisk.
278 disables a particular
283 field of each line specifies the action to be taken when the
285 field selects a message.
286 There are five forms:
289 A pathname (beginning with a leading slash).
290 Selected messages are appended to the file.
292 A hostname (preceded by an at
295 Selected messages are forwarded to the
297 program on the named host.
299 A comma separated list of users.
300 Selected messages are written to those users
301 if they are logged in.
304 Selected messages are written to all logged-in users.
308 followed by a command to pipe the selected
309 messages to. The command is passed to a
311 for evaluation, so usual shell metacharacters or input/output
312 redirection can occur. (Note however that redirecting
314 buffered output from the invoked command can cause additional delays,
315 or even lost output data in case a logging subprocess exited with a
316 signal.) The command itself runs with
325 will close the pipe to the process. If the process didn't exit
326 voluntarily, it will be sent a
328 signal after a grace period of up to 60 seconds.
330 The command will only be started once data arrives that should be piped
331 to it. If it exited later, it will be restarted as necessary. So if it
332 is desired that the subprocess should get exactly one line of input only
333 (which can be very resource-consuming if there are a lot of messages
334 flowing quickly), this can be achieved by exiting after just one line of
335 input. If necessary, a script wrapper can be written to this effect.
337 Unless the command is a full pipeline, it's probably useful to
338 start the command with
340 so that the invoking shell process does not wait for the command to
341 complete. Warning: the process is started under the UID invoking
343 normally the superuser.
346 Blank lines and lines whose first non-blank character is a hash
348 character are ignored.
350 A configuration file might appear as follows:
352 # Log all kernel messages, authentication messages of
353 # level notice or higher and anything of level err or
354 # higher to the console.
355 # Don't log private authentication messages!
356 *.err;kern.*;auth.notice;authpriv.none /dev/console
358 # Log anything (except mail) of level info or higher.
359 # Don't log private authentication messages!
360 *.info;mail.none;authpriv.none /var/log/messages
362 # Log daemon messages at debug level only
363 daemon.=debug /var/log/daemon.debug
365 # The authpriv file has restricted access.
366 authpriv.* /var/log/secure
368 # Log all the mail messages in one place.
369 mail.* /var/log/maillog
371 # Everybody gets emergency messages, plus log them on another
374 *.emerg @arpa.berkeley.edu
376 # Root and Eric get alert and higher messages.
379 # Save mail and news errors of level err and higher in a
381 uucp,news.crit /var/log/spoolerr
383 # Pipe all authentication messages to a filter.
384 auth.* |exec /usr/local/sbin/authfilter
386 # Save ftpd transactions along with mail and news
388 *.* /var/log/spoolerr
390 # Log all security messages to a separate file.
391 security.* /var/log/security
393 # Log all writes to /dev/console to a separate file.
394 console.* /var/log/console.log
396 .Sh IMPLEMENTATION NOTES
399 facility is usually reserved for messages
400 generated by the local kernel.
401 Other messages logged with facility
403 are usually translated to facility
405 This translation can be disabled,
410 .Bl -tag -width /etc/syslog.conf -compact
411 .It Pa /etc/syslog.conf
416 The effects of multiple
418 are sometimes not intuitive.
423 facility messages at the level of
425 or higher, not at the level of
429 In networked environments, note that not all operating systems
430 implement the same set of facilities. The facilities
431 authpriv, cron, ftp, and ntp that are known to this implementation
432 might be absent on the target system. Even worse, DEC UNIX uses
433 facility number 10 (which is authpriv in this implementation) to
434 log events for their AdvFS file system.