1.\" $NetBSD: syslogd.8,v 1.59 2022/11/08 01:43:09 uwe Exp $ 2.\" 3.\" Copyright (c) 1983, 1986, 1991, 1993 4.\" The Regents of the University of California. All rights reserved. 5.\" 6.\" Redistribution and use in source and binary forms, with or without 7.\" modification, are permitted provided that the following conditions 8.\" are met: 9.\" 1. Redistributions of source code must retain the above copyright 10.\" notice, this list of conditions and the following disclaimer. 11.\" 2. Redistributions in binary form must reproduce the above copyright 12.\" notice, this list of conditions and the following disclaimer in the 13.\" documentation and/or other materials provided with the distribution. 14.\" 3. Neither the name of the University nor the names of its contributors 15.\" may be used to endorse or promote products derived from this software 16.\" without specific prior written permission. 17.\" 18.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 19.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 20.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 21.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 22.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 23.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 24.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 25.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 26.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 27.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 28.\" SUCH DAMAGE. 29.\" 30.\" from: @(#)syslogd.8 8.1 (Berkeley) 6/6/93 31.\" 32.Dd November 8, 2022 33.Dt SYSLOGD 8 34.Os 35.Sh NAME 36.Nm syslogd 37.Nd log systems messages 38.Sh SYNOPSIS 39.Nm 40.Op Fl nrSsTUvX 41.Op Fl B Ar buffer_length 42.Op Fl b Ar bind_address 43.Op Fl d Op Oo Cm \&~ Oc Ns Ar what 44.Op Fl f Ar config_file 45.Op Fl g Ar group 46.Op Fl m Ar mark_interval 47.Op Fl o Ar output_format 48.Op Fl P Ar file_list 49.Oo 50.Fl p Ar log_socket 51.Op Fl p Ar log_socket2 ... 52.Oc 53.Op Fl t Ar chroot_dir 54.Op Fl u Ar user 55.Sh DESCRIPTION 56.Nm 57reads and logs messages to the system console, log files, other 58machines and/or users as specified by its configuration file. 59The options are as follows: 60.Bl -tag -width 15n 61.It Fl B Ar buffer_length 62Sets the receiving buffer length. 63The default is 16384 bytes. 64If syslogd reports buffer overflow, this needs increasing. 65If you don't care about it being reported, see the 66.Fl X 67option. 68.It Fl b Ar bind_address 69Specify one specific IP address or hostname to bind to. 70If a hostname is specified, the IPv4 or IPv6 address 71which corresponds to it is used. 72.It Fl d Op Oo Cm \&~ Oc Ns Ar what 73Do not disassociate from the controlling terminal and 74enable debugging to the standard output. 75The optional 76.Ar what 77argument is a number that selects which categories of the debug 78messages are to be enabled. 79A tilde 80.Pq Sq Cm \&~ 81before 82.Ar what 83inverts its meaning so that all messages except those selected by 84.Ar what 85are enabled. 86.It Fl f Ar config_file 87Specify the pathname of an alternative configuration file; 88the default is 89.Pa /etc/syslog.conf . 90.It Fl g Ar group 91Set GID to 92.Ar group 93after the sockets and log files have been opened. 94.It Fl m Ar mark_interval 95Select the number of minutes between ``mark'' messages; 96the default is 20 minutes. 97.It Fl n 98Do not perform hostname lookups; report only numeric addresses. 99.It Fl o Ar output_format 100Select output message format. 101.Bl -hang 102.It Em bsd , rfc3164 103traditional BSD Syslog format (default) 104.It Em syslog , rfc5424 105new syslog-protocol format 106.El 107.It Fl P 108Specify the pathname of a file containing a list of sockets to be 109created. 110The format of the file is simply one socket per line. 111.It Fl p Ar log_socket 112Specify the pathname of a log socket. 113Multiple 114.Fl p 115options create multiple log sockets. 116If no 117.Fl p 118arguments are given, the default socket of 119.Pa /var/run/log 120is used. 121.It Fl r 122Disable the compression of repeated instances of the same line 123into a single line of the form 124.Dq last message repeated N times . 125.It Fl S 126Sync kernel messages to disk immediately. 127.It Fl s 128Select 129.Dq secure 130mode, in which 131.Nm 132does not listen on a UDP socket but only communicates over a 133.Ux 134domain socket. 135This is valuable when the machine on 136which 137.Nm 138runs is subject to attack over the network and it is desired 139that the machine be protected from attempts to remotely fill logs 140and similar attacks. 141.It Fl T 142Always use the local time and date for messages received from the 143network, instead of the timestamp field supplied in the message 144by the remote host. 145This is useful if some of the originating hosts can't keep time 146properly or are unable to generate a correct timestamp. 147.It Fl t Ar chroot_dir 148.Xr chroot 2 149to 150.Ar chroot_dir 151after the sockets and log files have been opened. 152.It Fl U 153Unique priority logging. 154Only log messages at the priority specified by the selector in the 155configuration file. 156Without this option, messages at the specified priority or higher are 157logged. 158This option changes the default priority comparison from 159.Sq >= 160to 161.Sq = . 162.It Fl u Ar user 163Set UID to 164.Ar user 165after the sockets and log files have been opened. 166.It Fl v 167Verbose logging. 168If specified once, the numeric facility and priority are logged with 169each locally-written message. 170If specified more than once, the names of the facility and priority are 171logged with each locally-written message. 172.It Fl X 173Disable logging of buffer overflow. 174.El 175.Pp 176.Nm 177reads its configuration file when it starts up and whenever it 178receives a hangup signal. 179For information on the format of the configuration file, 180see 181.Xr syslog.conf 5 . 182.Pp 183.Nm 184reads messages from the 185.Ux 186domain socket 187.Pa /var/run/log , 188from an Internet domain socket specified in 189.Pa /etc/services , 190and from the special device 191.Pa /dev/klog 192(to read kernel messages). 193.Pp 194.Nm 195creates the file 196.Pa /var/run/syslogd.pid , 197and stores its process 198id there. 199This can be used to kill or reconfigure 200.Nm . 201.Pp 202By using multiple 203.Fl p 204options, one can set up many chroot environments by passing the pathname 205to the log socket 206.Pa ( /var/run/log ) 207in each chroot area to 208.Nm . 209For example: 210.Dl syslogd -p /var/run/log -p /web/var/run/log -p /ftp/var/run/log 211.Pp 212Note: the normal log socket must now also be passed to 213.Nm . 214.Pp 215The logged message includes the date, time, and hostname (or pathname of 216the log socket). 217Commonly, the program name and the process id is included. 218.Pp 219The date and time are taken from the received message. 220If the format of the timestamp field is incorrect, time obtained from 221the local host is used instead. 222This can be overridden by the 223.Fl T 224flag. 225.Pp 226Accesses from UDP socket can be filtered by libwrap configuration files, like 227.Pa /etc/hosts.deny . 228Specify 229.Dq Li syslogd 230in 231.Ar daemon_list 232portion of the configuration files. 233Refer to 234.Xr hosts_access 5 235for details. 236.Ss SYSLOG PROTOCOL NOTES 237.Nm 238accepts messages in traditional BSD Syslog or in newer Syslog Protocol 239format. 240See RFC 3164 (BSD Syslog) and RFC 5424 (Syslog Protocol) for detailed 241description of the message format. 242Messages from the local kernel that are not tagged with a priority code 243receive the default facility 244.Dv LOG_KERN 245and priority 246.Dv LOG_NOTICE . 247All other untagged messages receive the default facility 248.Dv LOG_USER 249and priority 250.Dv LOG_NOTICE . 251.Sh FILES 252.Bl -tag -width /var/run/syslogd.pid -compact 253.It Pa /etc/syslog.conf 254The configuration file. 255.It Pa /var/run/syslogd.pid 256The process id of current 257.Nm . 258.It Pa /var/run/log 259Name of the 260.Ux 261domain datagram log socket. 262.It Pa /dev/klog 263The kernel log device. 264.El 265.Sh SEE ALSO 266.Xr logger 1 , 267.Xr syslog 3 , 268.Xr services 5 , 269.Xr syslog.conf 5 , 270.Xr newsyslog 8 271.Rs 272.%R RFC 273.%N 3164 274.%D August 2001 275.%T The BSD syslog Protocol 276.Re 277.Rs 278.%R RFC 279.%N 5424 280.%D March 2009 281.%T The Syslog Protocol 282.Re 283.Sh HISTORY 284The 285.Nm 286command appeared in 287.Bx 4.3 . 288Support for multiple log sockets appeared in 289.Nx 1.4 . 290libwrap support appeared in 291.Nx 1.6 . 292Support for RFC 5424, TLS encryption and authentication, signed messages 293appeared in 294.Nx 6.0 . 295