1 '\" te 2 .\" Copyright (c) 2003 Sun Microsystems, Inc. All Rights Reserved. 3 .\" Copyright (c) 1983 Regents of the University of California. All rights reserved. The Berkeley software License Agreement specifies the terms and conditions for redistribution. 4 .TH SYSLOG.CONF 4 "Apr 26, 2006" 5 .SH NAME 6 syslog.conf \- configuration file for syslogd system log daemon 7 .SH SYNOPSIS 8 .LP 9 .nf 10 \fB/etc/syslog.conf\fR 11 .fi 12 13 .SH DESCRIPTION 14 .sp 15 .LP 16 The file \fB/etc/syslog.conf\fR contains information used by the system log 17 daemon, \fBsyslogd\fR(1M), to forward a system message to appropriate log files 18 and/or users. \fBsyslogd\fR preprocesses this file through \fBm4\fR(1) to 19 obtain the correct information for certain log files, defining \fBLOGHOST\fR if 20 the address of "loghost" is the same as one of the addresses of the host that 21 is running \fBsyslogd\fR. 22 .sp 23 .LP 24 A configuration entry is composed of two TAB-separated fields: 25 .sp 26 .in +2 27 .nf 28 \fIselector action\fR 29 .fi 30 .in -2 31 32 .sp 33 .LP 34 The \fIselector\fR field contains a semicolon-separated list of priority 35 specifications of the form: 36 .sp 37 .in +2 38 .nf 39 \fIfacility\fR\fB\&.\fR\fIlevel\fR [ \fB;\fR \fIfacility\fR\fB\&.\fR\fIlevel\fR ] 40 .fi 41 .in -2 42 43 .sp 44 .LP 45 where \fIfacility\fR is a system facility, or comma-separated list of 46 facilities, and \fIlevel\fR is an indication of the severity of the condition 47 being logged. Recognized values for \fIfacility\fR include: 48 .sp 49 .ne 2 50 .na 51 \fB\fBuser\fR\fR 52 .ad 53 .RS 12n 54 Messages generated by user processes. This is the default priority for messages 55 from programs or facilities not listed in this file. 56 .RE 57 58 .sp 59 .ne 2 60 .na 61 \fB\fBkern\fR\fR 62 .ad 63 .RS 12n 64 Messages generated by the kernel. 65 .RE 66 67 .sp 68 .ne 2 69 .na 70 \fB\fBmail\fR\fR 71 .ad 72 .RS 12n 73 The mail system. 74 .RE 75 76 .sp 77 .ne 2 78 .na 79 \fB\fBdaemon\fR\fR 80 .ad 81 .RS 12n 82 System daemons, such as \fBin.ftpd\fR(1M) 83 .RE 84 85 .sp 86 .ne 2 87 .na 88 \fB\fBauth\fR\fR 89 .ad 90 .RS 12n 91 The authorization system: \fBlogin\fR(1), \fBsu\fR(1M), \fBgetty\fR(1M), among 92 others. 93 .RE 94 95 .sp 96 .ne 2 97 .na 98 \fB\fBlpr\fR\fR 99 .ad 100 .RS 12n 101 The line printer spooling system: \fBlpr\fR(1B), \fBlpc\fR(1B), among others. 102 .RE 103 104 .sp 105 .ne 2 106 .na 107 \fB\fBnews\fR\fR 108 .ad 109 .RS 12n 110 Designated for the USENET network news system. 111 .RE 112 113 .sp 114 .ne 2 115 .na 116 \fB\fBuucp\fR\fR 117 .ad 118 .RS 12n 119 Designated for the UUCP system; it does not currently use the \fBsyslog\fR 120 mechanism. 121 .RE 122 123 .sp 124 .ne 2 125 .na 126 \fB\fBcron\fR\fR 127 .ad 128 .RS 12n 129 Designated for \fBcron\fR/\fBat\fR messages generated by systems that do 130 logging through \fBsyslog\fR. The current version of the Solaris Operating 131 Environment does not use this facility for logging. 132 .RE 133 134 .sp 135 .ne 2 136 .na 137 \fB\fBaudit\fR\fR 138 .ad 139 .RS 12n 140 Designated for audit messages generated by systems that audit by means of 141 syslog. 142 .RE 143 144 .sp 145 .ne 2 146 .na 147 \fB\fBlocal0-7\fR\fR 148 .ad 149 .RS 12n 150 Designated for local use. 151 .RE 152 153 .sp 154 .ne 2 155 .na 156 \fB\fBmark\fR\fR 157 .ad 158 .RS 12n 159 For timestamp messages produced internally by \fBsyslogd\fR. 160 .RE 161 162 .sp 163 .ne 2 164 .na 165 \fB\fB*\fR\fR 166 .ad 167 .RS 12n 168 An asterisk indicates all facilities except for the \fBmark\fR facility. 169 .RE 170 171 .sp 172 .LP 173 Recognized values for \fIlevel\fR are (in descending order of severity): 174 .sp 175 .ne 2 176 .na 177 \fB\fBemerg\fR\fR 178 .ad 179 .RS 11n 180 For panic conditions that would normally be broadcast to all users. 181 .RE 182 183 .sp 184 .ne 2 185 .na 186 \fB\fBalert\fR\fR 187 .ad 188 .RS 11n 189 For conditions that should be corrected immediately, such as a corrupted system 190 database. 191 .RE 192 193 .sp 194 .ne 2 195 .na 196 \fB\fBcrit\fR\fR 197 .ad 198 .RS 11n 199 For warnings about critical conditions, such as hard device errors. 200 .RE 201 202 .sp 203 .ne 2 204 .na 205 \fB\fBerr\fR\fR 206 .ad 207 .RS 11n 208 For other errors. 209 .RE 210 211 .sp 212 .ne 2 213 .na 214 \fB\fBwarning\fR\fR 215 .ad 216 .RS 11n 217 For warning messages. 218 .RE 219 220 .sp 221 .ne 2 222 .na 223 \fB\fBnotice\fR\fR 224 .ad 225 .RS 11n 226 For conditions that are not error conditions, but may require special handling. 227 A configuration entry with a \fIlevel\fR value of \fBnotice\fR must appear on a 228 separate line. 229 .RE 230 231 .sp 232 .ne 2 233 .na 234 \fB\fBinfo\fR\fR 235 .ad 236 .RS 11n 237 Informational messages. 238 .RE 239 240 .sp 241 .ne 2 242 .na 243 \fB\fBdebug\fR\fR 244 .ad 245 .RS 11n 246 For messages that are normally used only when debugging a program. 247 .RE 248 249 .sp 250 .ne 2 251 .na 252 \fB\fBnone\fR\fR 253 .ad 254 .RS 11n 255 Do not send messages from the indicated \fIfacility\fR to the selected file. 256 For example, a \fIselector\fR of 257 .sp 258 \fB*.debug;mail.none\fR 259 .sp 260 sends all messages \fIexcept\fR mail messages to the selected file. 261 .RE 262 263 .sp 264 .LP 265 For a given \fIfacility\fR and \fIlevel\fR, \fBsyslogd\fR matches all messages 266 for that level and all higher levels. For example, an entry that specifies a 267 level of \fBcrit\fR also logs messages at the \fBalert\fR and \fBemerg\fR 268 levels. 269 .sp 270 .LP 271 The \fIaction\fR field indicates where to forward the message. Values for this 272 field can have one of four forms: 273 .RS +4 274 .TP 275 .ie t \(bu 276 .el o 277 A filename, beginning with a leading slash, which indicates that messages 278 specified by the \fIselector\fR are to be written to the specified file. The 279 file is opened in append mode if it exists. If the file does not exist, logging 280 silently fails for this action. 281 .RE 282 .RS +4 283 .TP 284 .ie t \(bu 285 .el o 286 The name of a remote host, prefixed with an \fB@\fR, as with: 287 \fB@\fR\fIserver\fR, which indicates that messages specified by the 288 \fIselector\fR are to be forwarded to the \fBsyslogd\fR on the named host. The 289 hostname "loghost" is treated, in the default \fBsyslog.conf\fR, as the 290 hostname given to the machine that logs \fBsyslogd\fR messages. Every machine 291 is "loghost" by default, per the hosts database. It is also possible to specify 292 one machine on a network to be "loghost" by, literally, naming the machine 293 "loghost". If the local machine is designated to be "loghost", then 294 \fBsyslogd\fR messages are written to the appropriate files. Otherwise, they 295 are sent to the machine "loghost" on the network. 296 .RE 297 .RS +4 298 .TP 299 .ie t \(bu 300 .el o 301 A comma-separated list of usernames, which indicates that messages specified by 302 the \fIselector\fR are to be written to the named users if they are logged in. 303 .RE 304 .RS +4 305 .TP 306 .ie t \(bu 307 .el o 308 An asterisk, which indicates that messages specified by the \fIselector\fR are 309 to be written to all logged-in users. 310 .RE 311 .sp 312 .LP 313 Blank lines are ignored. Lines for which the first nonwhite character is 314 a '\fB#\fR' are treated as comments. 315 .SH EXAMPLES 316 .LP 317 \fBExample 1 \fRA Sample Configuration File 318 .sp 319 .LP 320 With the following configuration file: 321 322 .sp 323 324 .sp 325 .TS 326 l l 327 l l . 328 \fB*.notice\fR \fB/var/log/notice\fR 329 \fBmail.info\fR \fB/var/log/notice\fR 330 \fB*.crit\fR \fB/var/log/critical\fR 331 \fBkern,mark.debug\fR \fB/dev/console\fR 332 \fBkern.err\fR \fB@server\fR 333 \fB*.emerg\fR \fB*\fR 334 \fB*.alert\fR \fBroot,operator\fR 335 \fB*.alert;auth.warning\fR \fB/var/log/auth\fR 336 .TE 337 338 .sp 339 .LP 340 \fBsyslogd\fR(1M) logs all mail system messages except \fBdebug\fR messages and 341 all \fBnotice\fR (or higher) messages into a file named \fB/var/log/notice\fR. 342 It logs all critical messages into \fB/var/log/critical\fR, and all kernel 343 messages and 20-minute marks onto the system console. 344 345 .sp 346 .LP 347 Kernel messages of \fBerr\fR (error) severity or higher are forwarded to the 348 machine named \fBserver\fR. Emergency messages are forwarded to all users. The 349 users \fBroot\fR and \fBoperator\fR are informed of any \fBalert\fR messages. 350 All messages from the authorization system of \fBwarning\fR level or higher are 351 logged in the file \fB/var/log/auth\fR. 352 353 .SH ATTRIBUTES 354 .sp 355 .LP 356 See \fBattributes\fR(5) for descriptions of the following attributes: 357 .sp 358 359 .sp 360 .TS 361 box; 362 c | c 363 l | l . 364 ATTRIBUTE TYPE ATTRIBUTE VALUE 365 _ 366 Interface Stability Stable 367 .TE 368 369 .SH SEE ALSO 370 .sp 371 .LP 372 \fBat\fR(1), \fBcrontab\fR(1), \fBlogger\fR(1), \fBlogin\fR(1), \fBlp\fR(1), 373 \fBlpc\fR(1B), \fBlpr\fR(1B), \fBm4\fR(1), \fBcron\fR(1M), \fBgetty\fR(1M), 374 \fBin.ftpd\fR(1M), \fBsu\fR(1M), \fBsyslogd\fR(1M), \fBsyslog\fR(3C), 375 \fBhosts\fR(4), \fBattributes\fR(5)