1 .\" Copyright (c) 1990, 1991, 1993
2 .\" The Regents of the University of California. All rights reserved.
4 .\" Redistribution and use in source and binary forms, with or without
5 .\" modification, are permitted provided that the following conditions
7 .\" 1. Redistributions of source code must retain the above copyright
8 .\" notice, this list of conditions and the following disclaimer.
9 .\" 2. Redistributions in binary form must reproduce the above copyright
10 .\" notice, this list of conditions and the following disclaimer in the
11 .\" documentation and/or other materials provided with the distribution.
12 .\" 3. All advertising materials mentioning features or use of this software
13 .\" must display the following acknowledgement:
14 .\" This product includes software developed by the University of
15 .\" California, Berkeley and its contributors.
16 .\" 4. Neither the name of the University nor the names of its contributors
17 .\" may be used to endorse or promote products derived from this software
18 .\" without specific prior written permission.
20 .\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
21 .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23 .\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
24 .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25 .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26 .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27 .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28 .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32 .\" @(#)syslog.conf.5 8.1 (Berkeley) 6/9/93
46 file is the configuration file for the
50 blocks of lines separated by
54 specifications (separations appear along on the line),
55 with each line containing two fields: the
57 field which specifies the types of messages and priorities to which the
60 field which specifies the action to be taken if a message
62 receives matches the selection criteria.
65 field is separated from the
67 field by one or more tab characters or spaces.
69 Note that if you use spaces as separators, your
71 might be incompatible with other Unices or Unix-like systems.
72 This functionality was added for ease of configuration
73 (e.g.\& it is possible to cut-and-paste into
75 and to avoid possible mistakes.
76 This change however preserves
77 backwards compatibility with the old style of
79 (i.e., tab characters only).
87 an optional set of comparison flags
88 .Pq Oo \&! Oc Op <=> ,
91 with no intervening white-space.
100 describes the part of the system generating the message, and is one of
101 the following keywords: auth, authpriv, console, cron, daemon, ftp, kern,
102 lpr, mail, mark, news, ntp, security, syslog, user, uucp and local0 through
104 These keywords (with the exception of mark) correspond to
107 values specified to the
115 may be used to specify exactly what is logged.
116 The default comparison is
120 which means that messages from the specified
122 list, and of a priority
123 level equal to or greater than
126 Comparison flags beginning with
128 will have their logical sense inverted.
131 means all levels except info and
133 has the same meaning as
138 describes the severity of the message, and is a keyword from the
139 following ordered list (higher to lower): emerg, alert, crit, err,
140 warning, notice, info and debug.
141 These keywords correspond to
144 values specified to the
148 Each block of lines is separated from the previous block by a
153 A block will only log messages corresponding to the most recent
157 specifications given.
158 Thus, with a block which selects
162 directly followed by a block that selects messages from the
165 the second block will only log messages
172 specification is a line beginning with
176 (the former is for compatibility with the previous syslogd, if one is sharing
179 and the following blocks will be associated with calls to
181 from that specific program.
186 will also match any message logged by the kernel with the prefix
192 specification works just like the previous one,
197 specification will match any message but the ones from that
199 Multiple programs may be listed, separated by commas:
201 matches messages from either program, while
203 matches all messages but those from
210 specification of the form
214 means the following blocks will be applied to messages
215 received from the specified hostname.
222 causes the following blocks to be applied to messages
223 from any host but the one specified.
224 If the hostname is given as
226 the local hostname will be used.
227 As for program specifications, multiple comma-seprarated
228 values may be specified for hostname specifications.
234 specification may be reset by giving the program or hostname as
239 for further descriptions of both the
243 keywords and their significance.
244 It's preferred that selections be made on
248 since the latter can easily vary in a networked environment.
250 though, an appropriate
252 simply doesn't exist.
254 If a received message matches the specified
256 and is of the specified
258 .Em (or a higher level) ,
259 and the first word in the message after the date matches the
261 the action specified in the
267 may be specified for a single
269 by separating them with semicolon
272 It is important to note, however, that each
274 can modify the ones preceding it.
278 may be specified for a single
280 by separating them with comma
286 can be used to specify all
296 receives a message at priority
301 This is not enabled by a
303 field containing an asterisk.
308 disables a particular
313 field of each line specifies the action to be taken when the
315 field selects a message.
316 There are five forms:
319 A pathname (beginning with a leading slash).
320 Selected messages are appended to the file.
322 To ensure that kernel messages are written to disk promptly,
326 after writing messages from the kernel.
327 Other messages are not synced explicitly.
328 You may prefix a pathname with the minus sign,
330 to forego syncing the specified file after every kernel message.
331 Note that you might lose information if the system crashes
332 immediately following a write attempt.
333 Nevertheless, using the
335 option may improve performance,
336 especially if the kernel is logging many messages.
338 A hostname (preceded by an at
341 Selected messages are forwarded to the
343 program on the named host.
345 A comma separated list of users.
346 Selected messages are written to those users
347 if they are logged in.
350 Selected messages are written to all logged-in users.
354 followed by a command to pipe the selected
356 The command is passed to
358 for evaluation, so usual shell metacharacters or input/output
359 redirection can occur.
360 (Note however that redirecting
362 buffered output from the invoked command can cause additional delays,
363 or even lost output data in case a logging subprocess exited with a
365 The command itself runs with
374 will close the pipe to the process.
375 If the process didn't exit
376 voluntarily, it will be sent a
378 signal after a grace period of up to 60 seconds.
380 The command will only be started once data arrives that should be piped
382 If it exited later, it will be restarted as necessary.
384 is desired that the subprocess should get exactly one line of input only
385 (which can be very resource-consuming if there are a lot of messages
386 flowing quickly), this can be achieved by exiting after just one line of
388 If necessary, a script wrapper can be written to this effect.
390 Unless the command is a full pipeline, it's probably useful to
391 start the command with
393 so that the invoking shell process does not wait for the command to
395 Warning: the process is started under the UID invoking
397 normally the superuser.
400 Blank lines and lines whose first non-blank character is a hash
402 character are ignored.
404 A configuration file might appear as follows:
406 # Log all kernel messages, authentication messages of
407 # level notice or higher, and anything of level err or
408 # higher to the console.
409 # Don't log private authentication messages!
410 *.err;kern.*;auth.notice;authpriv.none /dev/console
412 # Log anything (except mail) of level info or higher.
413 # Don't log private authentication messages!
414 *.info;mail.none;authpriv.none /var/log/messages
416 # Log daemon messages at debug level only
417 daemon.=debug /var/log/daemon.debug
419 # The authpriv file has restricted access.
420 authpriv.* /var/log/secure
422 # Log all the mail messages in one place.
423 mail.* /var/log/maillog
425 # Everybody gets emergency messages, plus log them on another
428 *.emerg @arpa.berkeley.edu
430 # Root and Eric get alert and higher messages.
433 # Save mail and news errors of level err and higher in a
435 uucp,news.crit /var/log/spoolerr
437 # Pipe all authentication messages to a filter.
438 auth.* |exec /usr/local/sbin/authfilter
440 # Save ftpd transactions along with mail and news
442 *.* /var/log/spoolerr
444 # Log all security messages to a separate file.
445 security.* /var/log/security
447 # Log all writes to /dev/console to a separate file.
448 console.* /var/log/console.log
450 # Log ipfw messages without syncing after every message.
454 .Sh IMPLEMENTATION NOTES
457 facility is usually reserved for messages
458 generated by the local kernel.
459 Other messages logged with facility
461 are usually translated to facility
463 This translation can be disabled;
468 .Bl -tag -width /etc/syslog.conf -compact
469 .It Pa /etc/syslog.conf
474 The effects of multiple
476 are sometimes not intuitive.
481 facility messages at the level of
483 or higher, not at the level of
487 In networked environments, note that not all operating systems
488 implement the same set of facilities.
490 authpriv, cron, ftp, and ntp that are known to this implementation
491 might be absent on the target system.
492 Even worse, DEC UNIX uses
493 facility number 10 (which is authpriv in this implementation) to
494 log events for their AdvFS file system.