1*63041Sbostic.\" Copyright (c) 1990, 1991, 1993 2*63041Sbostic.\" The Regents of the University of California. All rights reserved. 345274Sbostic.\" 449649Scael.\" %sccs.include.redist.roff% 545274Sbostic.\" 6*63041Sbostic.\" @(#)syslog.conf.5 8.1 (Berkeley) 06/09/93 745274Sbostic.\" 849649Scael.Dd 949649Scael.Dt SYSLOG.CONF 5 1049649Scael.Os 1149649Scael.Sh NAME 1249649Scael.Nm syslog.conf 1349649Scael.Nd 1449649Scael.Xr syslogd 8 1549649Scaelconfiguration file 1649649Scael.Sh DESCRIPTION 1749649ScaelThe 1849649Scael.Nm syslog.conf 1949649Scaelfile is the configuration file for the 2049649Scael.Xr syslogd 8 2145274Sbosticprogram. 2245274SbosticIt consists of lines with two fields: the 2349649Scael.Em selector 2445274Sbosticfield which specifies the types of messages and priorities to which the 2545274Sbosticline applies, and an 2649649Scael.Em action 2745274Sbosticfield which specifies the action to be taken if a message 2849649Scael.Xr syslogd 2945274Sbosticreceives matches the selection criteria. 3045274SbosticThe 3149649Scael.Em selector 3245274Sbosticfield is separated from the 3349649Scael.Em action 3445274Sbosticfield by one or more tab characters. 3549649Scael.Pp 3649649ScaelThe 3749649Scael.Em Selectors 3849649Scaelfunction 3945274Sbosticare encoded as a 4049649Scael.Em facility , 4145274Sbostica period (``.''), and a 4249649Scael.Em level , 4345274Sbosticwith no intervening white-space. 4445274SbosticBoth the 4549649Scael.Em facility 4645274Sbosticand the 4749649Scael.Em level 4845274Sbosticare case insensitive. 4949649Scael.Pp 5045274SbosticThe 5149649Scael.Em facility 5245274Sbosticdescribes the part of the system generating the message, and is one of 5345274Sbosticthe following keywords: auth, authpriv, cron, daemon, kern, lpr, mail, 5445274Sbosticmark, news, syslog, user, uucp and local0 through local7. 5545274SbosticThese keywords (with the exception of mark) correspond to the 5649649Scaelsimilar 5749649Scael.Dq Dv LOG_ 5849649Scaelvalues specified to the 5949649Scael.Xr openlog 3 6045274Sbosticand 6149649Scael.Xr syslog 3 6245274Sbosticlibrary routines. 6349649Scael.Pp 6445274SbosticThe 6549649Scael.Em level 6645274Sbosticdescribes the severity of the message, and is a keyword from the 6745274Sbosticfollowing ordered list (higher to lower): emerg, alert, crit, err, 6845274Sbosticwarning, notice and debug. 6945274SbosticThese keywords correspond to the 7049649Scaelsimilar 7149649Scael.Pq Dv LOG_ 7249649Scaelvalues specified to the 7349649Scael.Xr syslog 7445274Sbosticlibrary routine. 7549649Scael.Pp 7645274SbosticSee 7749649Scael.Xr syslog 3 7845274Sbosticfor a further descriptions of both the 7949649Scael.Em facility 8045274Sbosticand 8149649Scael.Em level 8245274Sbostickeywords and their significance. 8349649Scael.Pp 8445274SbosticIf a received message matches the specified 8549649Scael.Em facility 8645274Sbosticand is of the specified 8749649Scael.Em level 8849649Scael.Em (or a higher level) , 8945274Sbosticthe action specified in the 9049649Scael.Em action 9145274Sbosticfield will be taken. 9249649Scael.Pp 9345274SbosticMultiple 9449649Scael.Em selectors 9545274Sbosticmay be specified for a single 9649649Scael.Em action 9745274Sbosticby separating them with semicolon (``;'') characters. 9845278SbosticIt is important to note, however, that each 9949649Scael.Em selector 10045278Sbosticcan modify the ones preceding it. 10149649Scael.Pp 10245274SbosticMultiple 10349649Scael.Em facilities 10445274Sbosticmay be specified for a single 10549649Scael.Em level 10645274Sbosticby separating them with comma (``,'') characters. 10749649Scael.Pp 10845274SbosticAn asterisk (``*'') can be used to specify all 10949649Scael.Em facilities 11045274Sbosticor all 11149649Scael.Em levels . 11249649Scael.Pp 11345274SbosticThe special 11449649Scael.Em facility 11545274Sbostic``mark'' receives a message at priority ``info'' every 20 minutes 11645274Sbostic(see 11749649Scael.Xr syslogd 8 ) . 11845274SbosticThis is not enabled by a 11949649Scael.Em facility 12045274Sbosticfield containing an asterisk. 12149649Scael.Pp 12245274SbosticThe special 12349649Scael.Em level 12445274Sbostic``none'' disables a particular 12549649Scael.Em facility . 12649649Scael.Pp 12745274SbosticThe 12849649Scael.Em action 12945274Sbosticfield of each line specifies the action to be taken when the 13049649Scael.Em selector 13145274Sbosticfield selects a message. 13245274SbosticThere are four forms: 13349649Scael.Bl -bullet 13449649Scael.It 13545274SbosticA pathname (beginning with a leading slash). 13645274SbosticSelected messages are appended to the file. 13749649Scael.It 13845274SbosticA hostname (preceded by an at (``@'') sign). 13945274SbosticSelected messages are forwarded to the 14049649Scael.Xr syslogd 14145274Sbosticprogram on the named host. 14249649Scael.It 14345274SbosticA comma separated list of users. 14445274SbosticSelected messages are written to those users 14545274Sbosticif they are logged in. 14649649Scael.It 14745274SbosticAn asterisk. 14845274SbosticSelected messages are written to all logged-in users. 14949649Scael.El 15049649Scael.Pp 15145274SbosticBlank lines and lines whose first non-blank character is a hash (``#'') 15245274Sbosticcharacter are ignored. 15349649Scael.Sh EXAMPLES 15449649Scael.Pp 15545274SbosticA configuration file might appear as follows: 15649649Scael.Bd -literal 15745274Sbostic# Log all kernel messages, authentication messages of 15845274Sbostic# level notice or higher and anything of level err or 15945274Sbostic# higher to the console. 16045274Sbostic# Don't log private authentication messages! 16145274Sbostic*.err;kern.*;auth.notice;authpriv.none /dev/console 16245274Sbostic 16345274Sbostic# Log anything (except mail) of level info or higher. 16445274Sbostic# Don't log private authentication messages! 16545274Sbostic*.info;mail.none;authpriv.none /var/log/messages 16645274Sbostic 16745274Sbostic# The authpriv file has restricted access. 16845274Sbosticauthpriv.* /var/log/secure 16945274Sbostic 17045274Sbostic# Log all the mail messages in one place. 17145274Sbosticmail.* /var/log/maillog 17245274Sbostic 17345274Sbostic# Everybody gets emergency messages, plus log them on another 17445274Sbostic# machine. 17545274Sbostic*.emerg * 17645274Sbostic*.emerg @arpa.berkeley.edu 17745274Sbostic 17845274Sbostic# Root and Eric get alert and higher messages. 17945274Sbostic*.alert root,eric 18045274Sbostic 18145274Sbostic# Save mail and news errors of level err and higher in a 18245274Sbostic# special file. 18345274Sbosticuucp,news.crit /var/log/spoolerr 18449649Scael.Ed 18549649Scael.Sh FILES 18649649Scael.Bl -tag -width /etc/syslog.conf -compact 18749649Scael.It Pa /etc/syslog.conf 18849649ScaelThe 18949649Scael.Xr syslogd 8 19049649Scaelconfiguration file. 19149649Scael.El 19249649Scael.Sh BUGS 19345278SbosticThe effects of multiple selectors are sometimes not intuitive. 19445278SbosticFor example ``mail.crit,*.err'' will select ``mail'' facility messages at 19545278Sbosticthe level of ``err'' or higher, not at the level of ``crit'' or higher. 19649649Scael.Sh SEE ALSO 19749649Scael.Xr syslog 3 , 19849649Scael.Xr syslogd 8 199