1*63041Sbostic.\" Copyright (c) 1990, 1991, 1993
2*63041Sbostic.\"	The Regents of the University of California.  All rights reserved.
345274Sbostic.\"
449649Scael.\" %sccs.include.redist.roff%
545274Sbostic.\"
6*63041Sbostic.\"     @(#)syslog.conf.5	8.1 (Berkeley) 06/09/93
745274Sbostic.\"
849649Scael.Dd
949649Scael.Dt SYSLOG.CONF 5
1049649Scael.Os
1149649Scael.Sh NAME
1249649Scael.Nm syslog.conf
1349649Scael.Nd
1449649Scael.Xr syslogd 8
1549649Scaelconfiguration file
1649649Scael.Sh DESCRIPTION
1749649ScaelThe
1849649Scael.Nm syslog.conf
1949649Scaelfile is the configuration file for the
2049649Scael.Xr syslogd 8
2145274Sbosticprogram.
2245274SbosticIt consists of lines with two fields: the
2349649Scael.Em selector
2445274Sbosticfield which specifies the types of messages and priorities to which the
2545274Sbosticline applies, and an
2649649Scael.Em action
2745274Sbosticfield which specifies the action to be taken if a message
2849649Scael.Xr syslogd
2945274Sbosticreceives matches the selection criteria.
3045274SbosticThe
3149649Scael.Em selector
3245274Sbosticfield is separated from the
3349649Scael.Em action
3445274Sbosticfield by one or more tab characters.
3549649Scael.Pp
3649649ScaelThe
3749649Scael.Em Selectors
3849649Scaelfunction
3945274Sbosticare encoded as a
4049649Scael.Em facility ,
4145274Sbostica period (``.''), and a
4249649Scael.Em level ,
4345274Sbosticwith no intervening white-space.
4445274SbosticBoth the
4549649Scael.Em facility
4645274Sbosticand the
4749649Scael.Em level
4845274Sbosticare case insensitive.
4949649Scael.Pp
5045274SbosticThe
5149649Scael.Em facility
5245274Sbosticdescribes the part of the system generating the message, and is one of
5345274Sbosticthe following keywords: auth, authpriv, cron, daemon, kern, lpr, mail,
5445274Sbosticmark, news, syslog, user, uucp and local0 through local7.
5545274SbosticThese keywords (with the exception of mark) correspond to the
5649649Scaelsimilar
5749649Scael.Dq Dv LOG_
5849649Scaelvalues specified to the
5949649Scael.Xr openlog 3
6045274Sbosticand
6149649Scael.Xr syslog 3
6245274Sbosticlibrary routines.
6349649Scael.Pp
6445274SbosticThe
6549649Scael.Em level
6645274Sbosticdescribes the severity of the message, and is a keyword from the
6745274Sbosticfollowing ordered list (higher to lower): emerg, alert, crit, err,
6845274Sbosticwarning, notice and debug.
6945274SbosticThese keywords correspond to the
7049649Scaelsimilar
7149649Scael.Pq Dv LOG_
7249649Scaelvalues specified to the
7349649Scael.Xr syslog
7445274Sbosticlibrary routine.
7549649Scael.Pp
7645274SbosticSee
7749649Scael.Xr syslog 3
7845274Sbosticfor a further descriptions of both the
7949649Scael.Em facility
8045274Sbosticand
8149649Scael.Em level
8245274Sbostickeywords and their significance.
8349649Scael.Pp
8445274SbosticIf a received message matches the specified
8549649Scael.Em facility
8645274Sbosticand is of the specified
8749649Scael.Em level
8849649Scael.Em (or a higher level) ,
8945274Sbosticthe action specified in the
9049649Scael.Em action
9145274Sbosticfield will be taken.
9249649Scael.Pp
9345274SbosticMultiple
9449649Scael.Em selectors
9545274Sbosticmay be specified for a single
9649649Scael.Em action
9745274Sbosticby separating them with semicolon (``;'') characters.
9845278SbosticIt is important to note, however, that each
9949649Scael.Em selector
10045278Sbosticcan modify the ones preceding it.
10149649Scael.Pp
10245274SbosticMultiple
10349649Scael.Em facilities
10445274Sbosticmay be specified for a single
10549649Scael.Em level
10645274Sbosticby separating them with comma (``,'') characters.
10749649Scael.Pp
10845274SbosticAn asterisk (``*'') can be used to specify all
10949649Scael.Em facilities
11045274Sbosticor all
11149649Scael.Em levels .
11249649Scael.Pp
11345274SbosticThe special
11449649Scael.Em facility
11545274Sbostic``mark'' receives a message at priority ``info'' every 20 minutes
11645274Sbostic(see
11749649Scael.Xr syslogd 8 ) .
11845274SbosticThis is not enabled by a
11949649Scael.Em facility
12045274Sbosticfield containing an asterisk.
12149649Scael.Pp
12245274SbosticThe special
12349649Scael.Em level
12445274Sbostic``none'' disables a particular
12549649Scael.Em facility .
12649649Scael.Pp
12745274SbosticThe
12849649Scael.Em action
12945274Sbosticfield of each line specifies the action to be taken when the
13049649Scael.Em selector
13145274Sbosticfield selects a message.
13245274SbosticThere are four forms:
13349649Scael.Bl -bullet
13449649Scael.It
13545274SbosticA pathname (beginning with a leading slash).
13645274SbosticSelected messages are appended to the file.
13749649Scael.It
13845274SbosticA hostname (preceded by an at (``@'') sign).
13945274SbosticSelected messages are forwarded to the
14049649Scael.Xr syslogd
14145274Sbosticprogram on the named host.
14249649Scael.It
14345274SbosticA comma separated list of users.
14445274SbosticSelected messages are written to those users
14545274Sbosticif they are logged in.
14649649Scael.It
14745274SbosticAn asterisk.
14845274SbosticSelected messages are written to all logged-in users.
14949649Scael.El
15049649Scael.Pp
15145274SbosticBlank lines and lines whose first non-blank character is a hash (``#'')
15245274Sbosticcharacter are ignored.
15349649Scael.Sh EXAMPLES
15449649Scael.Pp
15545274SbosticA configuration file might appear as follows:
15649649Scael.Bd -literal
15745274Sbostic# Log all kernel messages, authentication messages of
15845274Sbostic# level notice or higher and anything of level err or
15945274Sbostic# higher to the console.
16045274Sbostic# Don't log private authentication messages!
16145274Sbostic*.err;kern.*;auth.notice;authpriv.none	/dev/console
16245274Sbostic
16345274Sbostic# Log anything (except mail) of level info or higher.
16445274Sbostic# Don't log private authentication messages!
16545274Sbostic*.info;mail.none;authpriv.none		/var/log/messages
16645274Sbostic
16745274Sbostic# The authpriv file has restricted access.
16845274Sbosticauthpriv.*						/var/log/secure
16945274Sbostic
17045274Sbostic# Log all the mail messages in one place.
17145274Sbosticmail.*							/var/log/maillog
17245274Sbostic
17345274Sbostic# Everybody gets emergency messages, plus log them on another
17445274Sbostic# machine.
17545274Sbostic*.emerg							*
17645274Sbostic*.emerg							@arpa.berkeley.edu
17745274Sbostic
17845274Sbostic# Root and Eric get alert and higher messages.
17945274Sbostic*.alert							root,eric
18045274Sbostic
18145274Sbostic# Save mail and news errors of level err and higher in a
18245274Sbostic# special file.
18345274Sbosticuucp,news.crit						/var/log/spoolerr
18449649Scael.Ed
18549649Scael.Sh FILES
18649649Scael.Bl -tag -width /etc/syslog.conf -compact
18749649Scael.It Pa /etc/syslog.conf
18849649ScaelThe
18949649Scael.Xr syslogd 8
19049649Scaelconfiguration file.
19149649Scael.El
19249649Scael.Sh BUGS
19345278SbosticThe effects of multiple selectors are sometimes not intuitive.
19445278SbosticFor example ``mail.crit,*.err'' will select ``mail'' facility messages at
19545278Sbosticthe level of ``err'' or higher, not at the level of ``crit'' or higher.
19649649Scael.Sh SEE ALSO
19749649Scael.Xr syslog 3 ,
19849649Scael.Xr syslogd 8
199