| syslog.conf.5 (23004) | syslog.conf.5 (25276) |
|---|---|
| 1.\" Copyright (c) 1990, 1991, 1993 2.\" The Regents of the University of California. All rights reserved. 3.\" 4.\" Redistribution and use in source and binary forms, with or without 5.\" modification, are permitted provided that the following conditions 6.\" are met: 7.\" 1. Redistributions of source code must retain the above copyright 8.\" notice, this list of conditions and the following disclaimer. --- 16 unchanged lines hidden (view full) --- 25.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 26.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 27.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 29.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 30.\" SUCH DAMAGE. 31.\" 32.\" @(#)syslog.conf.5 8.1 (Berkeley) 6/9/93 | 1.\" Copyright (c) 1990, 1991, 1993 2.\" The Regents of the University of California. All rights reserved. 3.\" 4.\" Redistribution and use in source and binary forms, with or without 5.\" modification, are permitted provided that the following conditions 6.\" are met: 7.\" 1. Redistributions of source code must retain the above copyright 8.\" notice, this list of conditions and the following disclaimer. --- 16 unchanged lines hidden (view full) --- 25.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 26.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 27.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 29.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 30.\" SUCH DAMAGE. 31.\" 32.\" @(#)syslog.conf.5 8.1 (Berkeley) 6/9/93 |
| 33.\" $Id$ |
|
| 33.\" 34.Dd June 9, 1993 35.Dt SYSLOG.CONF 5 36.Os 37.Sh NAME 38.Nm syslog.conf 39.Nd 40.Xr syslogd 8 41configuration file 42.Sh DESCRIPTION 43The | 34.\" 35.Dd June 9, 1993 36.Dt SYSLOG.CONF 5 37.Os 38.Sh NAME 39.Nm syslog.conf 40.Nd 41.Xr syslogd 8 42configuration file 43.Sh DESCRIPTION 44The |
| 44.Nm syslog.conf | 45.Nm |
| 45file is the configuration file for the 46.Xr syslogd 8 47program. 48It consists of 49blocks of lines separated by 50.Em program 51specifications, 52with each line containing two fields: the --- 10 unchanged lines hidden (view full) --- 63.Em action 64field by one or more tab characters. 65.Pp 66The 67.Em Selectors 68function 69are encoded as a 70.Em facility , | 46file is the configuration file for the 47.Xr syslogd 8 48program. 49It consists of 50blocks of lines separated by 51.Em program 52specifications, 53with each line containing two fields: the --- 10 unchanged lines hidden (view full) --- 64.Em action 65field by one or more tab characters. 66.Pp 67The 68.Em Selectors 69function 70are encoded as a 71.Em facility , |
| 71a period (``.''), and a | 72a period 73.Pq Dq \&. , 74and a |
| 72.Em level , 73with no intervening white-space. 74Both the 75.Em facility 76and the 77.Em level 78are case insensitive. 79.Pp 80The 81.Em facility 82describes the part of the system generating the message, and is one of | 75.Em level , 76with no intervening white-space. 77Both the 78.Em facility 79and the 80.Em level 81are case insensitive. 82.Pp 83The 84.Em facility 85describes the part of the system generating the message, and is one of |
| 83the following keywords: auth, authpriv, cron, daemon, kern, lpr, mail, | 86the following keywords: auth, authpriv, cron, daemon, ftp, kern, lpr, mail, |
| 84mark, news, syslog, user, uucp and local0 through local7. 85These keywords (with the exception of mark) correspond to the 86similar 87.Dq Dv LOG_ 88values specified to the 89.Xr openlog 3 90and 91.Xr syslog 3 92library routines. 93.Pp 94The 95.Em level 96describes the severity of the message, and is a keyword from the 97following ordered list (higher to lower): emerg, alert, crit, err, 98warning, notice, info and debug. 99These keywords correspond to the 100similar | 87mark, news, syslog, user, uucp and local0 through local7. 88These keywords (with the exception of mark) correspond to the 89similar 90.Dq Dv LOG_ 91values specified to the 92.Xr openlog 3 93and 94.Xr syslog 3 95library routines. 96.Pp 97The 98.Em level 99describes the severity of the message, and is a keyword from the 100following ordered list (higher to lower): emerg, alert, crit, err, 101warning, notice, info and debug. 102These keywords correspond to the 103similar |
| 101.Pq Dv LOG_ | 104.Dq Dv LOG_ |
| 102values specified to the 103.Xr syslog 104library routine. 105.Pp 106Each block of lines is separated from the previous block by a tag. The tag 107is a line beginning with 108.Em #!prog 109or --- 11 unchanged lines hidden (view full) --- 121.Em level 122keywords and their significance. It's preferred that selections be made on 123.Em facility 124rather than 125.Em program , 126since the latter can easily vary in a networked environment. In some cases, 127though, an appropriate 128.Em facility | 105values specified to the 106.Xr syslog 107library routine. 108.Pp 109Each block of lines is separated from the previous block by a tag. The tag 110is a line beginning with 111.Em #!prog 112or --- 11 unchanged lines hidden (view full) --- 124.Em level 125keywords and their significance. It's preferred that selections be made on 126.Em facility 127rather than 128.Em program , 129since the latter can easily vary in a networked environment. In some cases, 130though, an appropriate 131.Em facility |
| 129simply doesn't exist (for example, 130.Em ftpd 131logs under LOG_DAEMON along with a myriad other programs). | 132simply doesn't exist. |
| 132.Pp 133If a received message matches the specified 134.Em facility 135and is of the specified 136.Em level 137.Em (or a higher level) , 138and the first word in the message after the date matches the 139.Em program , 140the action specified in the 141.Em action 142field will be taken. 143.Pp 144Multiple 145.Em selectors 146may be specified for a single 147.Em action | 133.Pp 134If a received message matches the specified 135.Em facility 136and is of the specified 137.Em level 138.Em (or a higher level) , 139and the first word in the message after the date matches the 140.Em program , 141the action specified in the 142.Em action 143field will be taken. 144.Pp 145Multiple 146.Em selectors 147may be specified for a single 148.Em action |
| 148by separating them with semicolon (``;'') characters. | 149by separating them with semicolon 150.Pq Dq \&; 151characters. |
| 149It is important to note, however, that each 150.Em selector 151can modify the ones preceding it. 152.Pp 153Multiple 154.Em facilities 155may be specified for a single 156.Em level | 152It is important to note, however, that each 153.Em selector 154can modify the ones preceding it. 155.Pp 156Multiple 157.Em facilities 158may be specified for a single 159.Em level |
| 157by separating them with comma (``,'') characters. | 160by separating them with comma 161.Pq Dq \&, 162characters. |
| 158.Pp | 163.Pp |
| 159An asterisk (``*'') can be used to specify all | 164An asterisk 165.Pq Dq * 166can be used to specify all |
| 160.Em facilities 161all 162.Em levels 163or all 164.Em programs . 165.Pp 166The special 167.Em facility | 167.Em facilities 168all 169.Em levels 170or all 171.Em programs . 172.Pp 173The special 174.Em facility |
| 168``mark'' receives a message at priority ``info'' every 20 minutes | 175.Dq mark 176receives a message at priority 177.Dq info 178every 20 minutes |
| 169(see 170.Xr syslogd 8 ) . 171This is not enabled by a 172.Em facility 173field containing an asterisk. 174.Pp 175The special 176.Em level | 179(see 180.Xr syslogd 8 ) . 181This is not enabled by a 182.Em facility 183field containing an asterisk. 184.Pp 185The special 186.Em level |
| 177``none'' disables a particular | 187.Dq none 188disables a particular |
| 178.Em facility . 179.Pp 180The 181.Em action 182field of each line specifies the action to be taken when the 183.Em selector 184field selects a message. 185There are five forms: 186.Bl -bullet 187.It 188A pathname (beginning with a leading slash). 189Selected messages are appended to the file. 190.It | 189.Em facility . 190.Pp 191The 192.Em action 193field of each line specifies the action to be taken when the 194.Em selector 195field selects a message. 196There are five forms: 197.Bl -bullet 198.It 199A pathname (beginning with a leading slash). 200Selected messages are appended to the file. 201.It |
| 191A hostname (preceded by an at (``@'') sign). | 202A hostname (preceded by an at 203.Pq Dq @ 204sign). |
| 192Selected messages are forwarded to the 193.Xr syslogd 194program on the named host. 195.It 196A comma separated list of users. 197Selected messages are written to those users 198if they are logged in. 199.It 200An asterisk. 201Selected messages are written to all logged-in users. 202.It | 205Selected messages are forwarded to the 206.Xr syslogd 207program on the named host. 208.It 209A comma separated list of users. 210Selected messages are written to those users 211if they are logged in. 212.It 213An asterisk. 214Selected messages are written to all logged-in users. 215.It |
| 203A vertical bar (``|''), followed by a command to pipe the selected | 216A vertical bar 217.Pq Dq \&| , 218followed by a command to pipe the selected |
| 204messages to. The command is passed to a 205.Pa /bin/sh 206for evaluation, so usual shell metacharacters or input/output 207redirection can occur. (Note however that redirecting 208.Xr stdio 3 209buffered output from the invoked command can cause additional delays, 210or even lost output data in case a logging subprocess exited with a 211signal.) The command itself runs with 212.Em stdout 213and 214.Em stderr 215redirected to 216.Pa /dev/null . 217Upon receipt of a 218.Dv SIGHUP , | 219messages to. The command is passed to a 220.Pa /bin/sh 221for evaluation, so usual shell metacharacters or input/output 222redirection can occur. (Note however that redirecting 223.Xr stdio 3 224buffered output from the invoked command can cause additional delays, 225or even lost output data in case a logging subprocess exited with a 226signal.) The command itself runs with 227.Em stdout 228and 229.Em stderr 230redirected to 231.Pa /dev/null . 232Upon receipt of a 233.Dv SIGHUP , |
| 219.Nm syslogd | 234.Nm |
| 220will close the pipe to the process. If the process didn't exit 221voluntarily, it will be sent a 222.Dv SIGTERM 223signal after a grace period of up to 40 seconds. 224.Pp 225The command will only be started once data arrives that should be piped 226to it. If it exited later, it will be restarted as necessary. 227.Pp 228Unless the command is a full pipeline, it's probably useful to 229start the command with 230.Em exec 231so that the invoking shell process does not wait for the command to 232complete. Warning: the process is started under the UID invoking 233.Xr syslogd 8 , 234normally the superuser. 235.El 236.Pp | 235will close the pipe to the process. If the process didn't exit 236voluntarily, it will be sent a 237.Dv SIGTERM 238signal after a grace period of up to 40 seconds. 239.Pp 240The command will only be started once data arrives that should be piped 241to it. If it exited later, it will be restarted as necessary. 242.Pp 243Unless the command is a full pipeline, it's probably useful to 244start the command with 245.Em exec 246so that the invoking shell process does not wait for the command to 247complete. Warning: the process is started under the UID invoking 248.Xr syslogd 8 , 249normally the superuser. 250.El 251.Pp |
| 237Blank lines and lines whose first non-blank character is a hash (``#'') | 252Blank lines and lines whose first non-blank character is a hash 253.Pq Dq # |
| 238character are ignored. 239.Sh EXAMPLES 240.Pp 241A configuration file might appear as follows: 242.Bd -literal 243# Log all kernel messages, authentication messages of 244# level notice or higher and anything of level err or 245# higher to the console. --- 33 unchanged lines hidden (view full) --- 279.Bl -tag -width /etc/syslog.conf -compact 280.It Pa /etc/syslog.conf 281The 282.Xr syslogd 8 283configuration file. 284.El 285.Sh BUGS 286The effects of multiple selectors are sometimes not intuitive. | 254character are ignored. 255.Sh EXAMPLES 256.Pp 257A configuration file might appear as follows: 258.Bd -literal 259# Log all kernel messages, authentication messages of 260# level notice or higher and anything of level err or 261# higher to the console. --- 33 unchanged lines hidden (view full) --- 295.Bl -tag -width /etc/syslog.conf -compact 296.It Pa /etc/syslog.conf 297The 298.Xr syslogd 8 299configuration file. 300.El 301.Sh BUGS 302The effects of multiple selectors are sometimes not intuitive. |
| 287For example ``mail.crit,*.err'' will select ``mail'' facility messages at 288the level of ``err'' or higher, not at the level of ``crit'' or higher. | 303For example 304.Dq mail.crit,*.err 305will select 306.Dq mail 307facility messages at the level of 308.Dq err 309or higher, not at the level of 310.Dq crit 311or higher. |
| 289.Sh SEE ALSO 290.Xr syslog 3 , 291.Xr syslogd 8 | 312.Sh SEE ALSO 313.Xr syslog 3 , 314.Xr syslogd 8 |