1.\" $NetBSD: syslogd.8,v 1.49 2009/10/15 20:35:07 plunky Exp $ 2.\" 3.\" Copyright (c) 1983, 1986, 1991, 1993 4.\" The Regents of the University of California. All rights reserved. 5.\" 6.\" Redistribution and use in source and binary forms, with or without 7.\" modification, are permitted provided that the following conditions 8.\" are met: 9.\" 1. Redistributions of source code must retain the above copyright 10.\" notice, this list of conditions and the following disclaimer. 11.\" 2. Redistributions in binary form must reproduce the above copyright 12.\" notice, this list of conditions and the following disclaimer in the 13.\" documentation and/or other materials provided with the distribution. 14.\" 3. Neither the name of the University nor the names of its contributors 15.\" may be used to endorse or promote products derived from this software 16.\" without specific prior written permission. 17.\" 18.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 19.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 20.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 21.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 22.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 23.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 24.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 25.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 26.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 27.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 28.\" SUCH DAMAGE. 29.\" 30.\" from: @(#)syslogd.8 8.1 (Berkeley) 6/6/93 31.\" 32.Dd October 15, 2009 33.Dt SYSLOGD 8 34.Os 35.Sh NAME 36.Nm syslogd 37.Nd log systems messages 38.Sh SYNOPSIS 39.Nm 40.Op Fl dnrSsTUv 41.Bk -words 42.Op Fl b Ar bind_address 43.Ek 44.Bk -words 45.Op Fl f Ar config_file 46.Ek 47.Bk -words 48.Op Fl g Ar group 49.Ek 50.Bk -words 51.Op Fl m Ar mark_interval 52.Ek 53.Bk -words 54.Op Fl o Ar output_format 55.Ek 56.Bk -words 57.Op Fl P Ar file_list 58.Ek 59.Bk -words 60.Oo 61.Fl p Ar log_socket 62.Op Fl p Ar log_socket2 ... 63.Oc 64.Ek 65.Bk -words 66.Op Fl t Ar chroot_dir 67.Ek 68.Bk -words 69.Op Fl u Ar user 70.Ek 71.Sh DESCRIPTION 72.Nm 73reads and logs messages to the system console, log files, other 74machines and/or users as specified by its configuration file. 75The options are as follows: 76.Bl -tag -width 15n 77.It Fl b Ar bind_address 78Specify one specific IP address or hostname to bind to. 79If a hostname is specified, the IPv4 or IPv6 address 80which corresponds to it is used. 81.It Fl d 82Enable debugging to the standard output, 83and do not disassociate from the controlling terminal. 84.It Fl f Ar config_file 85Specify the pathname of an alternative configuration file; 86the default is 87.Pa /etc/syslog.conf . 88.It Fl g Ar group 89Set GID to 90.Ar group 91after the sockets and log files have been opened. 92.It Fl m Ar mark_interval 93Select the number of minutes between ``mark'' messages; 94the default is 20 minutes. 95.It Fl n 96Do not perform hostname lookups; report only numeric addresses. 97.It Fl o Ar output_format 98Select output message format. 99.Bl -hang 100.It Em rfc3164 101traditional BSD Syslog format (default) 102.It Em syslog 103new syslog-protocol format 104.El 105.It Fl P 106Specify the pathname of a file containing a list of sockets to be 107created. 108The format of the file is simply one socket per line. 109.It Fl p Ar log_socket 110Specify the pathname of a log socket. 111Multiple 112.Fl p 113options create multiple log sockets. 114If no 115.Fl p 116arguments are created, the default socket of 117.Pa /var/run/log 118is used. 119.It Fl r 120Disable the compression of repeated instances of the same line 121into a single line of the form 122.Dq last message repeated N times . 123.It Fl S 124Sync kernel messages to disk immediately. 125.It Fl s 126Select 127.Dq secure 128mode, in which 129.Nm 130does not listen on a UDP socket but only communicates over a 131.Ux 132domain socket. 133This is valuable when the machine on 134which 135.Nm 136runs is subject to attack over the network and it is desired 137that the machine be protected from attempts to remotely fill logs 138and similar attacks. 139.It Fl t Ar chroot_dir 140.Xr chroot 2 141to 142.Ar chroot_dir 143after the sockets and log files have been opened. 144.It Fl T 145Always use the local time and date for messages received from the 146network, instead of the timestamp field supplied in the message 147by the remote host. 148This is useful if some of the originating hosts can't keep time 149properly or are unable to generate a correct timestamp. 150.It Fl u Ar user 151Set UID to 152.Ar user 153after the sockets and log files have been opened. 154.It Fl U 155Unique priority logging. 156Only log messages at the priority specified by the selector in the 157configuration file. 158Without this option, messages at the specified priority or higher are 159logged. 160This option changes the default priority comparison from 161.Sq \*[Gt]= 162to 163.Sq = . 164.It Fl v 165Verbose logging. 166If specified once, the numeric facility and priority are logged with 167each locally-written message. 168If specified more than once, the names of the facility and priority are 169logged with each locally-written message. 170.El 171.Pp 172.Nm 173reads its configuration file when it starts up and whenever it 174receives a hangup signal. 175For information on the format of the configuration file, 176see 177.Xr syslog.conf 5 . 178.Pp 179.Nm 180reads messages from the 181.Ux 182domain socket 183.Pa /var/run/log , 184from an Internet domain socket specified in 185.Pa /etc/services , 186and from the special device 187.Pa /dev/klog 188(to read kernel messages). 189.Pp 190.Nm 191creates the file 192.Pa /var/run/syslogd.pid , 193and stores its process 194id there. 195This can be used to kill or reconfigure 196.Nm . 197.Pp 198By using multiple 199.Fl p 200options, one can set up many chroot environments by passing the pathname 201to the log socket 202.Pa ( /var/run/log ) 203in each chroot area to 204.Nm . 205For example: 206.Dl syslogd -p /var/run/log -p /web/var/run/log -p /ftp/var/run/log 207.Pp 208Note: the normal log socket must now also be passed to 209.Nm . 210.Pp 211The logged message includes the date, time, and hostname (or pathname of 212the log socket). 213Commonly, the program name and the process id is included. 214.Pp 215The date and time are taken from the received message. 216If the format of the timestamp field is incorrect, time obtained from 217the local host is used instead. 218This can be overridden by the 219.Fl T 220flag. 221.Pp 222Accesses from UDP socket can be filtered by libwrap configuration files, like 223.Pa /etc/hosts.deny . 224Specify 225.Dq Li syslogd 226in 227.Ar daemon_list 228portion of the configuration files. 229Refer to 230.Xr hosts_access 5 231for details. 232.Ss SYSLOG PROTOCOL NOTES 233.Nm 234accepts messages in traditional BSD Syslog or in newer Syslog Protocol 235format. 236See RFC 3164 (BSD Syslog) and RFC 5424 (Syslog Protocol) for detailed 237description of the message format. 238Messages from the local kernel that are not tagged with a priority code 239receive the default facility 240.Dv LOG_KERN 241and priority 242.Dv LOG_NOTICE . 243All other untagged messages receive the default facility 244.Dv LOG_USER 245and priority 246.Dv LOG_NOTICE . 247.Sh FILES 248.Bl -tag -width /var/run/syslogd.pid -compact 249.It Pa /etc/syslog.conf 250The configuration file. 251.It Pa /var/run/syslogd.pid 252The process id of current 253.Nm . 254.It Pa /var/run/log 255Name of the 256.Ux 257domain datagram log socket. 258.It Pa /dev/klog 259The kernel log device. 260.El 261.Sh SEE ALSO 262.Xr logger 1 , 263.Xr syslog 3 , 264.Xr services 5 , 265.Xr syslog.conf 5 , 266.Xr newsyslog 8 267.Rs 268.%R RFC 269.%N 3164 270.%D August 2001 271.%T The BSD syslog Protocol 272.Re 273.Rs 274.%R RFC 275.%N 5424 276.%D March 2009 277.%T The Syslog Protocol 278.Re 279.Sh HISTORY 280The 281.Nm 282command appeared in 283.Bx 4.3 . 284Support for multiple log sockets appeared in 285.Nx 1.4 . 286libwrap support appeared in 287.Nx 1.6 . 288