1 .\" Copyright (c) 1990, 1991, 1993
2 .\" The Regents of the University of California. All rights reserved.
4 .\" Redistribution and use in source and binary forms, with or without
5 .\" modification, are permitted provided that the following conditions
7 .\" 1. Redistributions of source code must retain the above copyright
8 .\" notice, this list of conditions and the following disclaimer.
9 .\" 2. Redistributions in binary form must reproduce the above copyright
10 .\" notice, this list of conditions and the following disclaimer in the
11 .\" documentation and/or other materials provided with the distribution.
12 .\" 3. Neither the name of the University nor the names of its contributors
13 .\" may be used to endorse or promote products derived from this software
14 .\" without specific prior written permission.
16 .\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
17 .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19 .\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
20 .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21 .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22 .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23 .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24 .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
39 file is the configuration file for the
43 blocks of lines separated by
47 .Em property-based filter
48 specifications (separations appear alone on their lines),
49 with each line containing two fields: the
51 field which specifies the types of messages and priorities to which the
54 field which specifies the action to be taken if a message
56 receives matches the selection criteria.
59 field is separated from the
61 field by one or more tab characters or spaces.
65 keyword can be used to include all files with names ending in '.conf' and not
66 beginning with a '.' contained in the directory following the keyword.
67 This keyword can only be used in the first level configuration file.
69 Note that if you use spaces as separators, your
71 might be incompatible with other Unices or Unix-like systems.
72 This functionality was added for ease of configuration
73 (e.g.,\& it is possible to cut-and-paste into
75 and to avoid possible mistakes.
76 This change however preserves
77 backwards compatibility with the old style of
79 (i.e., tab characters only).
87 an optional set of comparison flags
88 .Pq Oo \&! Oc Op <=> ,
91 with no intervening white-space.
100 describes the part of the system generating the message, and is one of
101 the following keywords:
102 .Cm auth , authpriv , console , cron , daemon , ftp , kern , lpr ,
103 .Cm mail , mark , news , ntp , security , syslog , user , uucp ,
108 These keywords (with the exception of mark) correspond to
111 values specified to the
119 may be used to specify exactly what is logged.
120 The default comparison is
124 which means that messages from the specified
126 list, and of a priority
127 level equal to or greater than
130 Comparison flags beginning with
132 will have their logical sense inverted.
135 means all levels except info and
137 has the same meaning as
142 describes the severity of the message, and is a keyword from the
143 following ordered list (higher to lower):
144 .Cm emerg , alert , crit , err , warning , notice , info
147 These keywords correspond to
150 values specified to the
154 Each block of lines is separated from the previous block by a
158 .Em property-based filter
160 A block will only log messages corresponding to the most recent
164 .Em property-based filter
165 specifications given.
166 Thus, with a block which selects
170 directly followed by a block that selects messages from the
173 the second block will only log messages
180 specification is a line beginning with
184 (the former is for compatibility with the previous syslogd, if one is sharing
187 and the following blocks will be associated with calls to
189 from that specific program.
194 will also match any message logged by the kernel with the prefix
200 specification works just like the previous one,
205 specification will match any message but the ones from that
207 Multiple programs may be listed, separated by commas:
209 matches messages from either program, while
211 matches all messages but those from
218 specification of the form
222 means the following blocks will be applied to messages
223 received from the specified hostname.
230 causes the following blocks to be applied to messages
231 from any host but the one specified.
232 If the hostname is given as
234 the local hostname will be used.
235 As for program specifications, multiple comma-separated
236 values may be specified for hostname specifications.
239 .Em property-based filter
240 specification is a line beginning with
244 and the following blocks will be applied only when filter value
245 matches given filter propertie's value.
247 .Sx PROPERTY-BASED FILTERS
248 section for more details.
254 .Em property-based filter
255 specification may be reset by giving
261 for further descriptions of both the
265 keywords and their significance.
266 It is preferred that selections be made on
270 since the latter can easily vary in a networked environment.
272 though, an appropriate
274 simply does not exist.
276 If a received message matches the specified
278 and is of the specified
280 .Em (or a higher level) ,
281 and the first word in the message after the date matches the
283 the action specified in the
289 may be specified for a single
291 by separating them with semicolon
294 It is important to note, however, that each
296 can modify the ones preceding it.
300 may be specified for a single
302 by separating them with comma
308 can be used to specify all
318 receives a message at priority
323 This is not enabled by a
325 field containing an asterisk.
330 disables a particular
335 field of each line specifies the action to be taken when the
337 field selects a message.
338 There are five forms:
341 A pathname (beginning with a leading slash).
342 Selected messages are appended to the file.
344 To ensure that kernel messages are written to disk promptly,
348 after writing messages from the kernel.
349 Other messages are not synced explicitly.
350 You may prefix a pathname with the minus sign,
352 to forego syncing the specified file after every kernel message.
353 Note that you might lose information if the system crashes
354 immediately following a write attempt.
355 Nevertheless, using the
357 option may improve performance,
358 especially if the kernel is logging many messages.
360 A hostname (preceded by an at
363 Selected messages are forwarded to the
365 program on the named host.
366 If a port number is added after a colon
368 then that port will be used as the destination port
369 rather than the usual syslog port.
370 IPv6 addresses can be used
371 by surrounding the address portion with
379 A comma separated list of users.
380 Selected messages are written to those users
381 if they are logged in.
384 Selected messages are written to all logged-in users.
388 followed by a command to pipe the selected
390 The command is passed to
392 for evaluation, so usual shell metacharacters or input/output
393 redirection can occur.
394 (Note however that redirecting
396 buffered output from the invoked command can cause additional delays,
397 or even lost output data in case a logging subprocess exited with a
399 The command itself runs with
408 will close the pipe to the process.
409 If the process did not exit
410 voluntarily, it will be sent a
412 signal after a grace period of up to 60 seconds.
414 The command will only be started once data arrives that should be piped
416 If it exited later, it will be restarted as necessary.
418 is desired that the subprocess should get exactly one line of input only
419 (which can be very resource-consuming if there are a lot of messages
420 flowing quickly), this can be achieved by exiting after just one line of
422 If necessary, a script wrapper can be written to this effect.
424 Unless the command is a full pipeline, it is probably useful to
425 start the command with
427 so that the invoking shell process does not wait for the command to
429 Warning: the process is started under the UID invoking
431 normally the superuser.
434 Blank lines and lines whose first non-blank character is a hash
436 character are ignored.
439 is placed in the middle of the line, the
441 character and the rest of the line after it is ignored.
442 To prevent special meaning, the
444 character may be escaped with
446 in this case preceding
450 is treated as an ordinary character.
451 .Sh PROPERTY-BASED FILTERS
454 specifications performs exact match filtering against explicit field only.
455 .Em Property-based filters
456 feature substring and regular expressions (see
458 matching against various message attributes.
459 Filter specification starts with
463 followed by three comma-separated fields
464 .Em property , operator , \&"value\&" .
465 Value must be double-quoted.
466 A double quote and backslash must be escaped by a backslash.
470 are supported as test value:
475 - body of the message received.
478 - program name sent the message
481 - hostname of message's originator
484 - an alias for hostname
487 Operator specifies a comparison function between
489 value against filter's value.
495 - true if filter value is found as a substring of
499 - true if filter value is equal to
503 - true if property starts with filter value
506 - true if property matches basic regular expression defined in filter value
509 - true if property matches extended regular expression defined in filter value
512 Operator may be prefixed by
517 - to invert compare logic
520 - to make comparison function case insensitive
522 .Sh IMPLEMENTATION NOTES
525 facility is usually reserved for messages
526 generated by the local kernel.
527 Other messages logged with facility
529 are usually translated to facility
531 This translation can be disabled;
536 .Bl -tag -width /etc/syslog.conf -compact
537 .It Pa /etc/syslog.conf
542 A configuration file might appear as follows:
544 # Log all kernel messages, authentication messages of
545 # level notice or higher, and anything of level err or
546 # higher to the console.
547 # Do not log private authentication messages!
548 *.err;kern.*;auth.notice;authpriv.none;mail.crit /dev/console
550 # Log anything (except mail) of level info or higher.
551 # Do not log private authentication messages!
552 *.info;mail.none;authpriv.none /var/log/messages
554 # Log daemon messages at debug level only
555 daemon.=debug /var/log/daemon.debug
557 # The authpriv file has restricted access.
558 authpriv.* /var/log/secure
560 # Log all the mail messages in one place.
561 mail.* /var/log/maillog
563 # Everybody gets emergency messages, plus log them on another
566 *.emerg @arpa.berkeley.edu
568 # Root and Eric get alert and higher messages.
571 # Save mail and news errors of level err and higher in a
573 uucp,news.crit /var/log/spoolerr
575 # Pipe all authentication messages to a filter.
576 auth.* |exec /usr/local/sbin/authfilter
578 # Log all security messages to a separate file.
579 security.* /var/log/security
581 # Log all writes to /dev/console to a separate file.
582 console.* /var/log/console.log
584 # Save ftpd transactions along with mail and news
586 *.* /var/log/spoolerr
588 # Log ipfw messages without syncing after every message.
592 # Log ipfw messages with "Deny" in the message body.
593 :msg, contains, ".*Deny.*"
594 *.* /var/log/ipfw.deny
596 # Reset program name filtering
599 # Log messages from bird or bird6 into one file
600 :programname, regex, "^bird6?$"
601 *.* /var/log/bird-all.log
603 # Log messages from servers in racks 10-19 in multiple locations, case insensitive
604 :hostname, icase_ereregex, "^server-(dcA|podB|cdn)-rack1[0-9]{2}\\..*"
605 *.* /var/log/racks10..19.log
611 The effects of multiple
613 are sometimes not intuitive.
618 facility messages at the level of
620 or higher, not at the level of
624 In networked environments, note that not all operating systems
625 implement the same set of facilities.
627 authpriv, cron, ftp, and ntp that are known to this implementation
628 might be absent on the target system.
629 Even worse, DEC UNIX uses
630 facility number 10 (which is authpriv in this implementation) to
631 log events for their AdvFS file system.