1.\" Copyright (c) 1990, 1991, 1993 2.\" The Regents of the University of California. All rights reserved. 3.\" 4.\" Redistribution and use in source and binary forms, with or without 5.\" modification, are permitted provided that the following conditions 6.\" are met: 7.\" 1. Redistributions of source code must retain the above copyright 8.\" notice, this list of conditions and the following disclaimer. 9.\" 2. Redistributions in binary form must reproduce the above copyright 10.\" notice, this list of conditions and the following disclaimer in the 11.\" documentation and/or other materials provided with the distribution. 12.\" 3. Neither the name of the University nor the names of its contributors 13.\" may be used to endorse or promote products derived from this software 14.\" without specific prior written permission. 15.\" 16.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 17.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 20.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 21.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 22.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 23.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 24.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 25.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26.\" SUCH DAMAGE. 27.\" 28.\" from: @(#)syslog.conf.5 8.1 (Berkeley) 6/9/93 29.\" $OpenBSD: syslog.conf.5,v 1.38 2018/07/23 19:02:49 kn Exp $ 30.\" $NetBSD: syslog.conf.5,v 1.4 1996/01/02 17:41:46 perry Exp $ 31.\" 32.Dd $Mdocdate: July 23 2018 $ 33.Dt SYSLOG.CONF 5 34.Os 35.Sh NAME 36.Nm syslog.conf 37.Nd syslogd(8) configuration file 38.Sh DESCRIPTION 39The 40.Nm syslog.conf 41file is the configuration file for the 42.Xr syslogd 8 43program. 44It consists of blocks of lines separated by 45.Em program 46specifications, with each line containing two fields: the 47.Em selector 48field which specifies the types of messages and priorities to which the 49line applies, and an 50.Em action 51field which specifies the action to be taken if a message 52.Xr syslogd 8 53receives matches the selection criteria. 54The 55.Em selector 56field is separated from the 57.Em action 58field by one or more tab or space characters. 59.Pp 60The 61.Em selectors 62are encoded as a 63.Em facility , 64a period 65.Pq Ql \&. , 66and a 67.Em level , 68with no intervening whitespace. 69Both the 70.Em facility 71and the 72.Em level 73are case insensitive. 74.Pp 75The 76.Em facility 77describes the part of the system generating the message, and is one of 78the following keywords: auth, authpriv, cron, daemon, ftp, kern, lpr, mail, 79mark, news, syslog, user, uucp and local0 through local7. 80These keywords (with the exception of mark) correspond to the 81similar 82.Dq Dv LOG_ 83values specified to the 84.Xr openlog 3 85and 86.Xr syslog 3 87library routines. 88.Pp 89The 90.Em level 91describes the severity of the message, and is a keyword from the 92following ordered list (highest to lowest): emerg, alert, crit, err, 93warning, notice, info and debug. 94These keywords correspond to the 95similar 96.Pq Dv LOG_ 97values specified to the 98.Xr syslog 3 99library routine. 100.Pp 101Each block of lines is separated from the previous block by a tag. 102The tag is a line beginning with 103.Em !prog 104and each block will be associated with calls to syslog from that specific 105program (matched using 106.Xr glob 7 107rules). 108When a message matches multiple blocks, the action of each matching 109block is taken. 110If no tag is specified at the beginning of the file, 111every line is checked for a match and acted upon 112.Pq at least until a tag is found . 113.Pp 114.Em !!prog 115causes the subsequent block to abort evaluation when a message matches, 116ensuring that only a single set of actions is taken. 117.Em !*\& 118can be used to ensure that any ensuing blocks are further evaluated 119(i.e. cancelling the effect of a 120.Em !prog 121or 122.Em !!prog ) . 123.Pp 124Blocks starting with 125.Em +host 126or 127.Em ++host 128or 129.Em +* 130work the same way as their 131.Em prog 132counterparts, but they match on the hostname instead of the program 133name. 134.Pp 135See 136.Xr syslog 3 137for further descriptions of both the 138.Em facility 139and 140.Em level 141keywords and their significance. 142It's recommended that selections be made on 143.Em facility 144rather than 145.Em program , 146since the latter can easily vary in a networked environment. 147In some cases, though, an appropriate 148.Em facility 149simply doesn't exist. 150.Pp 151If a received message matches the specified 152.Em facility 153and is of the specified 154.Em level 155.Pq Em or a higher level , 156and the first word in the message after the date matches the 157.Em program , 158the action specified in the 159.Em action 160field will be taken. 161.Pp 162Multiple 163.Em selectors 164may be specified for a single 165.Em action 166by separating them with semicolon 167.Pq Ql \&; 168characters. 169It is important to note, however, that each 170.Em selector 171can modify the ones preceding it. 172.Pp 173Multiple 174.Em facilities 175may be specified for a single 176.Em level 177by separating them with comma 178.Pq Ql \&, 179characters. 180.Pp 181An asterisk 182.Pq Ql * 183can be used to specify all 184.Em facilities , 185all 186.Em levels 187or all 188.Em programs . 189.Pp 190The special 191.Em facility 192.Dq mark 193receives a message at priority 194.Dq info 195every 20 minutes (see 196.Xr syslogd 8 ) . 197This is not enabled by a 198.Em facility 199field containing an asterisk. 200.Pp 201The special 202.Em level 203.Dq none 204disables a particular 205.Em facility . 206.Pp 207The 208.Em action 209field of each line specifies the action to be taken when the 210.Em selector 211field selects a message. 212There are six forms: 213.Bl -bullet 214.It 215A pathname (beginning with a leading slash). 216Selected messages are appended to the file. 217.It 218A pipe to another program (beginning with a leading pipe symbol). 219The given program is started and presented the selected messages 220on its standard input. 221If the program exits, 222.Xr syslogd 8 223tries to restart it. 224.It 225A hostname (preceded by an at 226.Pq Ql @ 227sign). 228Selected messages are forwarded to the 229.Xr syslogd 8 230program on the named host. 231A port number may be specified using the 232.Ar host:port 233syntax. 234This is optional for UDP and TLS. 235There is no well-known port for syslog over TCP, so in this case it 236is mandatory to specify the port. 237IPv6 addresses can be used by surrounding the address portion with 238square brackets 239.Po 240.Ql [\& 241and 242.Ql ]\& 243.Pc . 244A prefix udp4:// or udp6:// in front of the hostname and after the 245at sign will force IPv4 or IPv6 addresses for UDP transport. 246The prefixes tcp[46]:// or tls[46]:// send messages over TCP or 247TLS, respectively, with an optional IP version 4 or 6. 248.It 249A comma separated list of users. 250Selected messages are written to those users 251if they are logged in. 252.It 253An asterisk. 254Selected messages are written to all logged-in users. 255.It 256A colon, followed by a memory buffer size 257.Pq in kilobytes , 258followed by another colon, followed by a buffer name. 259Selected messages are written to an in-memory buffer that may be read using 260.Xr syslogc 8 . 261Memory buffered logging is useful to provide access to log data on devices 262that lack local storage (e.g. diskless workstations or routers). 263The largest allowed buffer size is 256kb. 264.El 265.Pp 266Blank lines and lines whose first non-blank character is a hash 267.Pq Ql # 268character are ignored. 269.Sh FILES 270.Bl -tag -width /etc/syslog.conf -compact 271.It Pa /etc/syslog.conf 272The 273.Xr syslogd 8 274configuration file. 275.El 276.Sh EXAMPLES 277A configuration file might appear as follows: 278.Bd -literal 279# Log info (and higher) messages from spamd only to 280# a dedicated file, discarding debug messages. 281# Matching messages abort evaluation of further rules. 282!!spamd 283daemon.info /var/log/spamd 284daemon.debug /dev/null 285!* 286 287# Log all kernel messages, authentication messages of 288# level notice or higher and anything of level err or 289# higher to the console. 290# Don't log private authentication messages! 291*.err;kern.*;auth.notice;authpriv.none /dev/console 292 293# Log anything (except mail) of level info or higher. 294# Don't log private authentication messages! 295*.info;mail.none;authpriv.none /var/log/messages 296 297# The authpriv file has restricted access. 298authpriv.* /var/log/secure 299 300# Log all the mail messages in one place. 301mail.* /var/log/maillog 302 303# Everybody gets emergency messages, plus log them on another 304# machine. 305*.emerg * 306*.emerg @arpa.berkeley.edu 307 308# Root and Eric get alert and higher messages. 309*.alert root,eric 310 311# Log everything coming from host bastion to a separate file. 312++bastion 313*.* /var/log/bastion 314+* 315 316# Save mail and news errors of level err and higher in a 317# special file. 318mail,news.err /var/log/spoolerr 319 320# Save ftpd transactions along with mail and news. 321!ftpd 322*.* /var/log/spoolerr 323 324# Keep a copy of all logging in a 32k memory buffer named "debug". 325*.debug :32:debug 326 327# Store notices and authpriv messages in a 64k buffer named "important". 328*.notice,authpriv.* :64:important 329 330# Feed everything to logsurfer. 331*.* |/usr/local/sbin/logsurfer 332.Ed 333.Sh SEE ALSO 334.Xr syslog 3 , 335.Xr syslogc 8 , 336.Xr syslogd 8 337.Sh HISTORY 338The 339.Nm 340file appeared in 341.Bx 4.3 , 342along with 343.Xr syslogd 8 . 344.Pp 345Historic versions of 346.Xr syslogd 8 347did not support space-delimited fields. 348.Sh BUGS 349The effects of multiple selectors are sometimes not intuitive. 350For example 351.Dq mail.crit;*.err 352will select 353.Dq mail 354facility messages at the level of 355.Dq err 356or higher, not at the level of 357.Dq crit 358or higher. 359