1 .\" Copyright (c) 1990, 1991, 1993
2 .\" The Regents of the University of California. All rights reserved.
4 .\" Redistribution and use in source and binary forms, with or without
5 .\" modification, are permitted provided that the following conditions
7 .\" 1. Redistributions of source code must retain the above copyright
8 .\" notice, this list of conditions and the following disclaimer.
9 .\" 2. Redistributions in binary form must reproduce the above copyright
10 .\" notice, this list of conditions and the following disclaimer in the
11 .\" documentation and/or other materials provided with the distribution.
12 .\" 3. Neither the name of the University nor the names of its contributors
13 .\" may be used to endorse or promote products derived from this software
14 .\" without specific prior written permission.
16 .\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
17 .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19 .\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
20 .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21 .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22 .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23 .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24 .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28 .\" @(#)syslog.conf.5 8.1 (Berkeley) 6/9/93
42 file is the configuration file for the
46 blocks of lines separated by
50 .Em property-based filter
51 specifications (separations appear alone on their lines),
52 with each line containing two fields: the
54 field which specifies the types of messages and priorities to which the
57 field which specifies the action to be taken if a message
59 receives matches the selection criteria.
62 field is separated from the
64 field by one or more tab characters or spaces.
68 keyword can be used to include all files with names ending in '.conf' and not
69 beginning with a '.' contained in the directory following the keyword.
70 This keyword can only be used in the first level configuration file.
72 Note that if you use spaces as separators, your
74 might be incompatible with other Unices or Unix-like systems.
75 This functionality was added for ease of configuration
76 (e.g.,\& it is possible to cut-and-paste into
78 and to avoid possible mistakes.
79 This change however preserves
80 backwards compatibility with the old style of
82 (i.e., tab characters only).
90 an optional set of comparison flags
91 .Pq Oo \&! Oc Op <=> ,
94 with no intervening white-space.
103 describes the part of the system generating the message, and is one of
104 the following keywords:
105 .Cm auth , authpriv , console , cron , daemon , ftp , kern , lpr ,
106 .Cm mail , mark , news , ntp , security , syslog , user , uucp ,
111 These keywords (with the exception of mark) correspond to
114 values specified to the
122 may be used to specify exactly what is logged.
123 The default comparison is
127 which means that messages from the specified
129 list, and of a priority
130 level equal to or greater than
133 Comparison flags beginning with
135 will have their logical sense inverted.
138 means all levels except info and
140 has the same meaning as
145 describes the severity of the message, and is a keyword from the
146 following ordered list (higher to lower):
147 .Cm emerg , alert , crit , err , warning , notice , info
150 These keywords correspond to
153 values specified to the
157 Each block of lines is separated from the previous block by a
161 .Em property-based filter
163 A block will only log messages corresponding to the most recent
167 .Em property-based filter
168 specifications given.
169 Thus, with a block which selects
173 directly followed by a block that selects messages from the
176 the second block will only log messages
183 specification is a line beginning with
187 (the former is for compatibility with the previous syslogd, if one is sharing
190 and the following blocks will be associated with calls to
192 from that specific program.
197 will also match any message logged by the kernel with the prefix
203 specification works just like the previous one,
208 specification will match any message but the ones from that
210 Multiple programs may be listed, separated by commas:
212 matches messages from either program, while
214 matches all messages but those from
221 specification of the form
225 means the following blocks will be applied to messages
226 received from the specified hostname.
233 causes the following blocks to be applied to messages
234 from any host but the one specified.
235 If the hostname is given as
237 the local hostname will be used.
238 As for program specifications, multiple comma-separated
239 values may be specified for hostname specifications.
242 .Em property-based filter
243 specification is a line beginning with
247 and the following blocks will be applied only when filter value
248 matches given filter propertie's value.
250 .Sx PROPERTY-BASED FILTERS
251 section for more details.
257 .Em property-based filter
258 specification may be reset by giving
264 for further descriptions of both the
268 keywords and their significance.
269 It is preferred that selections be made on
273 since the latter can easily vary in a networked environment.
275 though, an appropriate
277 simply does not exist.
279 If a received message matches the specified
281 and is of the specified
283 .Em (or a higher level) ,
284 and the first word in the message after the date matches the
286 the action specified in the
292 may be specified for a single
294 by separating them with semicolon
297 It is important to note, however, that each
299 can modify the ones preceding it.
303 may be specified for a single
305 by separating them with comma
311 can be used to specify all
321 receives a message at priority
326 This is not enabled by a
328 field containing an asterisk.
333 disables a particular
338 field of each line specifies the action to be taken when the
340 field selects a message.
341 There are five forms:
344 A pathname (beginning with a leading slash).
345 Selected messages are appended to the file.
347 To ensure that kernel messages are written to disk promptly,
351 after writing messages from the kernel.
352 Other messages are not synced explicitly.
353 You may prefix a pathname with the minus sign,
355 to forego syncing the specified file after every kernel message.
356 Note that you might lose information if the system crashes
357 immediately following a write attempt.
358 Nevertheless, using the
360 option may improve performance,
361 especially if the kernel is logging many messages.
363 A hostname (preceded by an at
366 Selected messages are forwarded to the
368 program on the named host.
369 If a port number is added after a colon
371 then that port will be used as the destination port
372 rather than the usual syslog port.
373 IPv6 addresses can be used
374 by surrounding the address portion with
382 A comma separated list of users.
383 Selected messages are written to those users
384 if they are logged in.
387 Selected messages are written to all logged-in users.
391 followed by a command to pipe the selected
393 The command is passed to
395 for evaluation, so usual shell metacharacters or input/output
396 redirection can occur.
397 (Note however that redirecting
399 buffered output from the invoked command can cause additional delays,
400 or even lost output data in case a logging subprocess exited with a
402 The command itself runs with
411 will close the pipe to the process.
412 If the process did not exit
413 voluntarily, it will be sent a
415 signal after a grace period of up to 60 seconds.
417 The command will only be started once data arrives that should be piped
419 If it exited later, it will be restarted as necessary.
421 is desired that the subprocess should get exactly one line of input only
422 (which can be very resource-consuming if there are a lot of messages
423 flowing quickly), this can be achieved by exiting after just one line of
425 If necessary, a script wrapper can be written to this effect.
427 Unless the command is a full pipeline, it is probably useful to
428 start the command with
430 so that the invoking shell process does not wait for the command to
432 Warning: the process is started under the UID invoking
434 normally the superuser.
437 Blank lines and lines whose first non-blank character is a hash
439 character are ignored.
442 is placed in the middle of the line, the
444 character and the rest of the line after it is ignored.
445 To prevent special meaning, the
447 character may be escaped with
449 in this case preceding
453 is treated as an ordinary character.
454 .Sh PROPERTY-BASED FILTERS
457 specifications performs exact match filtering against explicit field only.
458 .Em Property-based filters
459 feature substring and regular expressions (see
461 matching against various message attributes.
462 Filter specification starts with
466 followed by three comma-separated fields
467 .Em property , operator , \&"value\&" .
468 Value must be double-quoted.
469 A double quote and backslash must be escaped by a backslash.
473 are supported as test value:
478 - body of the message received.
481 - program name sent the message
484 - hostname of message's originator
487 - an alias for hostname
490 Operator specifies a comparison function between
492 value against filter's value.
498 - true if filter value is found as a substring of
502 - true if filter value is equal to
506 - true if property starts with filter value
509 - true if property matches basic regular expression defined in filter value
512 - true if property matches extended regular expression defined in filter value
515 Operator may be prefixed by
520 - to invert compare logic
523 - to make comparison function case insensitive
525 .Sh IMPLEMENTATION NOTES
528 facility is usually reserved for messages
529 generated by the local kernel.
530 Other messages logged with facility
532 are usually translated to facility
534 This translation can be disabled;
539 .Bl -tag -width /etc/syslog.conf -compact
540 .It Pa /etc/syslog.conf
545 A configuration file might appear as follows:
547 # Log all kernel messages, authentication messages of
548 # level notice or higher, and anything of level err or
549 # higher to the console.
550 # Do not log private authentication messages!
551 *.err;kern.*;auth.notice;authpriv.none;mail.crit /dev/console
553 # Log anything (except mail) of level info or higher.
554 # Do not log private authentication messages!
555 *.info;mail.none;authpriv.none /var/log/messages
557 # Log daemon messages at debug level only
558 daemon.=debug /var/log/daemon.debug
560 # The authpriv file has restricted access.
561 authpriv.* /var/log/secure
563 # Log all the mail messages in one place.
564 mail.* /var/log/maillog
566 # Everybody gets emergency messages, plus log them on another
569 *.emerg @arpa.berkeley.edu
571 # Root and Eric get alert and higher messages.
574 # Save mail and news errors of level err and higher in a
576 uucp,news.crit /var/log/spoolerr
578 # Pipe all authentication messages to a filter.
579 auth.* |exec /usr/local/sbin/authfilter
581 # Log all security messages to a separate file.
582 security.* /var/log/security
584 # Log all writes to /dev/console to a separate file.
585 console.* /var/log/console.log
587 # Save ftpd transactions along with mail and news
589 *.* /var/log/spoolerr
591 # Log ipfw messages without syncing after every message.
595 # Log ipfw messages with "Deny" in the message body.
596 :msg, contains, ".*Deny.*"
597 *.* /var/log/ipfw.deny
599 # Reset program name filtering
602 # Log messages from bird or bird6 into one file
603 :programname, regex, "^bird6?$"
604 *.* /var/log/bird-all.log
606 # Log messages from servers in racks 10-19 in multiple locations, case insensitive
607 :hostname, icase_ereregex, "^server-(dcA|podB|cdn)-rack1[0-9]{2}\\..*"
608 *.* /var/log/racks10..19.log
614 The effects of multiple
616 are sometimes not intuitive.
621 facility messages at the level of
623 or higher, not at the level of
627 In networked environments, note that not all operating systems
628 implement the same set of facilities.
630 authpriv, cron, ftp, and ntp that are known to this implementation
631 might be absent on the target system.
632 Even worse, DEC UNIX uses
633 facility number 10 (which is authpriv in this implementation) to
634 log events for their AdvFS file system.