1.\" $NetBSD: syslog.conf.5,v 1.11 2003/08/07 11:25:44 agc Exp $ 2.\" 3.\" Copyright (c) 1990, 1991, 1993 4.\" The Regents of the University of California. All rights reserved. 5.\" 6.\" Redistribution and use in source and binary forms, with or without 7.\" modification, are permitted provided that the following conditions 8.\" are met: 9.\" 1. Redistributions of source code must retain the above copyright 10.\" notice, this list of conditions and the following disclaimer. 11.\" 2. Redistributions in binary form must reproduce the above copyright 12.\" notice, this list of conditions and the following disclaimer in the 13.\" documentation and/or other materials provided with the distribution. 14.\" 3. Neither the name of the University nor the names of its contributors 15.\" may be used to endorse or promote products derived from this software 16.\" without specific prior written permission. 17.\" 18.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 19.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 20.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 21.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 22.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 23.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 24.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 25.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 26.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 27.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 28.\" SUCH DAMAGE. 29.\" 30.\" from: @(#)syslog.conf.5 8.1 (Berkeley) 6/9/93 31.\" 32.Dd June 9, 1993 33.Dt SYSLOG.CONF 5 34.Os 35.Sh NAME 36.Nm syslog.conf 37.Nd 38.Xr syslogd 8 39configuration file 40.Sh DESCRIPTION 41The 42.Nm 43file is the configuration file for the 44.Xr syslogd 8 45program. 46It consists of lines with two fields: the 47.Em selector 48field which specifies the types of messages and priorities to which the 49line applies, and an 50.Em action 51field which specifies the action to be taken if a message 52.Xr syslogd 8 53receives matches the selection criteria. 54The 55.Em selector 56field is separated from the 57.Em action 58field by one or more tab characters. 59.Pp 60The 61.Em Selectors 62function 63are encoded as a 64.Em facility , 65a period 66.Pq Sq \&. , 67and a 68.Em level , 69with no intervening white-space. 70Both the 71.Em facility 72and the 73.Em level 74are case insensitive. 75.Pp 76The 77.Em facility 78describes the part of the system generating the message, and is one of 79the following keywords: auth, authpriv, cron, ftp, daemon, kern, lpr, 80mail, mark, news, syslog, user, uucp and local0 through local7. 81These keywords (with the exception of mark) correspond to the 82similar 83.Dq Dv LOG_ 84values specified to the 85.Xr openlog 3 86and 87.Xr syslog 3 88library routines. 89.Pp 90The 91.Em level 92describes the severity of the message, and is a keyword from the 93following ordered list (higher to lower): emerg, alert, crit, err, 94warning, notice, info and debug. 95These keywords correspond to the 96similar 97.Pq Dv LOG_ 98values specified to the 99.Xr syslog 3 100library routine. 101.Pp 102See 103.Xr syslog 3 104for a further descriptions of both the 105.Em facility 106and 107.Em level 108keywords and their significance. 109.Pp 110If a received message matches the specified 111.Em facility 112and is of the specified 113.Em level 114.Em (or a higher level) , 115the action specified in the 116.Em action 117field will be taken. 118.Pp 119Multiple 120.Em selectors 121may be specified for a single 122.Em action 123by separating them with semicolon 124.Pq Sq \&; 125characters. 126It is important to note, however, that each 127.Em selector 128can modify the ones preceding it. 129.Pp 130Multiple 131.Em facilities 132may be specified for a single 133.Em level 134by separating them with comma 135.Pq Sq \&, 136characters. 137.Pp 138An asterisk 139.Pq Sq \&* 140can be used to specify all 141.Em facilities 142or all 143.Em levels . 144.Pp 145The special 146.Em facility 147.Dq mark 148receives a message at priority 149.Dq info 150every 20 minutes 151(see 152.Xr syslogd 8 ) . 153This is not enabled by a 154.Em facility 155field containing an asterisk. 156.Pp 157The special 158.Em level 159.Dq none 160disables a particular 161.Em facility . 162.Pp 163The 164.Em action 165field of each line specifies the action to be taken when the 166.Em selector 167field selects a message. 168There are four forms: 169.Bl -bullet 170.It 171A pathname (beginning with a leading slash). 172Selected messages are appended to the file. 173.It 174A hostname (preceded by an at 175.Pq Sq @ 176sign). 177Selected messages are forwarded to the 178.Xr syslogd 8 179program on the named host. 180.It 181A comma separated list of users. 182Selected messages are written to those users 183if they are logged in. 184.It 185An asterisk. 186Selected messages are written to all logged-in users. 187.El 188.Pp 189Blank lines and lines whose first non-blank character is a hash 190.Pq Sq # 191character are ignored. 192.Sh FILES 193.Bl -tag -width /etc/syslog.conf -compact 194.It Pa /etc/syslog.conf 195The 196.Xr syslogd 8 197configuration file. 198.El 199.Sh EXAMPLES 200A configuration file might appear as follows: 201.Bd -literal 202# Log all kernel messages, authentication messages of 203# level notice or higher and anything of level err or 204# higher to the console. 205# Don't log private authentication messages! 206*.err;kern.*;auth.notice;authpriv.none /dev/console 207 208# Log anything (except mail) of level info or higher. 209# Don't log private authentication messages! 210*.info;mail.none;authpriv.none /var/log/messages 211 212# The authpriv file has restricted access. 213authpriv.* /var/log/secure 214 215# Log all the mail messages in one place. 216mail.* /var/log/maillog 217 218# Everybody gets emergency messages, plus log them on another 219# machine. 220*.emerg * 221*.emerg @arpa.berkeley.edu 222 223# Root and Eric get alert and higher messages. 224*.alert root,eric 225 226# Save mail and news errors of level err and higher in a 227# special file. 228mail,news.err /var/log/spoolerr 229.Ed 230.Sh SEE ALSO 231.Xr syslog 3 , 232.Xr syslogd 8 233.Sh HISTORY 234The 235.Nm 236file appeared in 237.Bx 4.3 , 238along with 239.Xr syslogd 8 . 240.Sh BUGS 241The effects of multiple selectors are sometimes not intuitive. 242For example 243.Dq mail.crit;*.err 244will select 245.Dq mail 246facility messages at 247the level of 248.Dq err 249or higher, not at the level of 250.Dq crit 251or higher. 252