1 '\" te 2 .\" Copyright (C) 2008, Sun Microsystems, Inc. All Rights Reserved 3 .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License"). You may not use this file except in compliance with the License. 4 .\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing. See the License for the specific language governing permissions and limitations under the License. 5 .\" When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE. If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner] 6 .TH SYSLOGD 1M "Oct 31, 2008" 7 .SH NAME 8 syslogd \- log system messages 9 .SH SYNOPSIS 10 .LP 11 .nf 12 \fB/usr/sbin/syslogd\fR [\fB-d\fR] [\fB-f\fR \fIconfigfile\fR] [\fB-m\fR \fImarkinterval\fR] 13 [\fB-p\fR \fIpath\fR] [\fB-t\fR | \fB-T\fR] 14 .fi 15 16 .SH DESCRIPTION 17 .sp 18 .LP 19 \fBsyslogd\fR reads and forwards system messages to the appropriate log files 20 or users, depending upon the priority of a message and the system facility from 21 which it originates. The configuration file \fB/etc/syslog.conf\fR (see 22 \fBsyslog.conf\fR(4)) controls where messages are forwarded. \fBsyslogd\fR logs 23 a mark (timestamp) message every \fImarkinterval\fR minutes (default \fB20\fR) 24 at priority \fBLOG_INFO\fR to the facility whose name is given as \fBmark\fR in 25 the \fBsyslog.conf\fR file. 26 .sp 27 .LP 28 A system message consists of a single line of text, which may be prefixed with 29 a priority code number enclosed in angle-brackets (\fB<\|>\fR); priorities are 30 defined in \fB<sys/syslog.h>\fR\&. 31 .sp 32 .LP 33 \fBsyslogd\fR reads from the \fBSTREAMS\fR log driver, \fB/dev/log\fR, and from 34 any transport provider specified in \fB/etc/netconfig\fR, 35 \fB/etc/net/transport/hosts\fR, and \fB/etc/net/transport/services\fR. 36 .sp 37 .LP 38 \fBsyslogd\fR reads the configuration file when it starts up, and again 39 whenever it receives a \fBHUP\fR signal (see \fBsignal.h\fR(3HEAD), at which 40 time it also closes all files it has open, re-reads its configuration file, and 41 then opens only the log files that are listed in that file. \fBsyslogd\fR exits 42 when it receives a \fBTERM\fR signal. 43 .sp 44 .LP 45 As it starts up, \fBsyslogd\fR creates the file \fB/var/run/syslog.pid\fR, if 46 possible, containing its process identifier (\fBPID\fR). 47 .sp 48 .LP 49 If message \fBID\fR generation is enabled (see \fBlog\fR(7D)), each message 50 will be preceded by an identifier in the following format: \fB[ID\fR \fImsgid 51 facility\fR\fB\&.\fR\fIpriority\fR\fB]\fR. \fImsgid\fR is the message's numeric 52 identifier described in \fBmsgid\fR(1M). \fIfacility\fR and \fIpriority\fR are 53 described in \fBsyslog.conf\fR(4). \fB[ID 123456 kern.notice]\fR is an example 54 of an identifier when message \fBID\fR generation is enabled. 55 .sp 56 .LP 57 If the message originated in a loadable kernel module or driver, the kernel 58 module's name (for example, \fBufs\fR) will be displayed instead of \fBunix\fR. 59 See \fBEXAMPLES\fR for sample output from \fBsyslogd\fR with and without 60 message \fBID\fR generation enabled. 61 .sp 62 .LP 63 In an effort to reduce visual clutter, message \fBID\fRs are not displayed when 64 writing to the console; message \fBID\fRs are only written to the log file. 65 See . 66 .sp 67 .LP 68 The \fB/etc/default/syslogd\fR file contains the following default parameter 69 settings, which are in effect if neither the \fB-t\fR nor \fB-T\fR option is 70 selected. See \fBFILES\fR. 71 .sp 72 .LP 73 The recommended way to allow or disallow message logging is through the use of 74 the service management facility (\fBsmf\fR(5)) property: 75 .sp 76 .in +2 77 .nf 78 svc:/system/system-log/config/log_from_remote 79 .fi 80 .in -2 81 82 .sp 83 .LP 84 This property specifies whether remote messages are logged. 85 \fBlog_from_remote=true\fR is equivalent to the \fB-t\fR command-line option 86 and \fBfalse\fR is equivalent to the \fB-T\fR command-line option. The default 87 value for \fB-log_from_remote\fR is \fBfalse\fR. See NOTES, below. 88 .sp 89 .ne 2 90 .na 91 \fB\fBLOG_FROM_REMOTE\fR\fR 92 .ad 93 .sp .6 94 .RS 4n 95 Specifies whether remote messages are logged. \fBLOG_FROM_REMOTE=NO\fR is 96 equivalent to the \fB-t\fR command-line option. The default value for 97 \fBLOG_FROM_REMOTE\fR is \fBYES\fR. 98 .RE 99 100 .SH OPTIONS 101 .sp 102 .LP 103 The following options are supported: 104 .sp 105 .ne 2 106 .na 107 \fB\fB-d\fR\fR 108 .ad 109 .sp .6 110 .RS 4n 111 Turn on debugging. This option should only be used interactively in a root 112 shell once the system is in multi-user mode. It should \fBnot\fR be used in the 113 system start-up scripts, as this will cause the system to hang at the point 114 where \fBsyslogd\fR is started. 115 .RE 116 117 .sp 118 .ne 2 119 .na 120 \fB\fB-f\fR \fIconfigfile\fR\fR 121 .ad 122 .sp .6 123 .RS 4n 124 Specify an alternate configuration file. 125 .RE 126 127 .sp 128 .ne 2 129 .na 130 \fB\fB-m\fR \fImarkinterval\fR\fR 131 .ad 132 .sp .6 133 .RS 4n 134 Specify an interval, in minutes, between mark messages. 135 .RE 136 137 .sp 138 .ne 2 139 .na 140 \fB\fB-p\fR \fIpath\fR\fR 141 .ad 142 .sp .6 143 .RS 4n 144 Specify an alternative log device name. The default is \fB/dev/log\fR. 145 .RE 146 147 .sp 148 .ne 2 149 .na 150 \fB\fB-T\fR\fR 151 .ad 152 .sp .6 153 .RS 4n 154 Enable the \fBsyslogd\fR \fBUDP\fR port to turn on logging of remote messages. 155 This is the default behavior. See . 156 .RE 157 158 .sp 159 .ne 2 160 .na 161 \fB\fB-t\fR\fR 162 .ad 163 .sp .6 164 .RS 4n 165 Disable the \fBsyslogd\fR \fBUDP\fR port to turn off logging of remote 166 messages. See . 167 .RE 168 169 .SH EXAMPLES 170 .LP 171 \fBExample 1 \fR\fBsyslogd\fR Output Without Message ID Generation Enabled 172 .sp 173 .LP 174 The following example shows the output from \fBsyslogd\fR when message \fBID\fR 175 generation \fBis not\fR enabled: 176 177 .sp 178 .in +2 179 .nf 180 Sep 29 21:41:18 cathy unix: alloc /: file system full 181 .fi 182 .in -2 183 .sp 184 185 .LP 186 \fBExample 2 \fR\fBsyslogd\fR Output with ID generation Enabled 187 .sp 188 .LP 189 The following example shows the output from \fBsyslogd\fR when message \fBID\fR 190 generation \fBis\fR enabled. The message \fBID\fR is displayed when writing to 191 log file\fB/var/adm/messages\fR. 192 193 .sp 194 .in +2 195 .nf 196 Sep 29 21:41:18 cathy ufs: [ID 845546 kern.notice] 197 alloc /: file system full 198 .fi 199 .in -2 200 .sp 201 202 .LP 203 \fBExample 3 \fR\fBsyslogd\fR Output with ID Generation Enabled 204 .sp 205 .LP 206 The following example shows the output from \fBsyslogd\fR when message \fBID\fR 207 generation \fBis\fR enabled when writing to the console. Even though message ID 208 is enabled, the message \fBID\fR is not displayed at the console. 209 210 .sp 211 .in +2 212 .nf 213 Sep 29 21:41:18 cathy ufs: alloc /: file system full 214 .fi 215 .in -2 216 .sp 217 218 .LP 219 \fBExample 4 \fREnabling Acceptance of UDP Messages from Remote Systems 220 .sp 221 .LP 222 The following commands enable \fBsyslogd\fR to accept entries from remote 223 systems. 224 225 .sp 226 .in +2 227 .nf 228 # \fBsvccfg -s svc:/system/system-log setprop config/log_from_remote = true\fR 229 # \fBsvcadm restart svc:/system/system-log\fR 230 .fi 231 .in -2 232 .sp 233 234 .SH FILES 235 .sp 236 .ne 2 237 .na 238 \fB\fB/etc/syslog.conf\fR\fR 239 .ad 240 .sp .6 241 .RS 4n 242 Configuration file 243 .RE 244 245 .sp 246 .ne 2 247 .na 248 \fB\fB/var/run/syslog.pid\fR\fR 249 .ad 250 .sp .6 251 .RS 4n 252 Process \fBID\fR 253 .RE 254 255 .sp 256 .ne 2 257 .na 258 \fB\fB/etc/default/syslogd\fR\fR 259 .ad 260 .sp .6 261 .RS 4n 262 Contains default settings. You can override some of the settings by 263 command-line options. 264 .RE 265 266 .sp 267 .ne 2 268 .na 269 \fB\fB/dev/log\fR\fR 270 .ad 271 .sp .6 272 .RS 4n 273 \fBSTREAMS\fR log driver 274 .RE 275 276 .sp 277 .ne 2 278 .na 279 \fB\fB/etc/netconfig\fR\fR 280 .ad 281 .sp .6 282 .RS 4n 283 Transport providers available on the system 284 .RE 285 286 .sp 287 .ne 2 288 .na 289 \fB\fB/etc/net/transport/hosts\fR\fR 290 .ad 291 .sp .6 292 .RS 4n 293 Network hosts for each transport 294 .RE 295 296 .sp 297 .ne 2 298 .na 299 \fB\fB/etc/net/transport/services\fR\fR 300 .ad 301 .sp .6 302 .RS 4n 303 Network services for each transport 304 .RE 305 306 .SH SEE ALSO 307 .sp 308 .LP 309 \fBlogger\fR(1), \fBsvcs\fR(1), \fBmsgid\fR(1M), \fBsvcadm\fR(1M), 310 \fBsvccfg\fR(1M), \fBsyslog\fR(3C), \fBsyslog.conf\fR(4), \fBattributes\fR(5), 311 \fBsignal.h\fR(3HEAD), \fBsmf\fR(5), \fBlog\fR(7D) 312 .SH NOTES 313 .sp 314 .LP 315 The \fBmark\fR message is a system time stamp, and so it is only defined for 316 the system on which \fBsyslogd\fR is running. It can not be forwarded to other 317 systems. 318 .sp 319 .LP 320 When \fBsyslogd\fR receives a \fBHUP\fR signal, it attempts to complete 321 outputting pending messages, and close all log files to which it is currently 322 logging messages. If, for some reason, one (or more) of these files does not 323 close within a generous grace period, \fBsyslogd\fR discards the pending 324 messages, forcibly closes these files, and starts reconfiguration. If this 325 shutdown procedure is disturbed by an unexpected error and \fBsyslogd\fR cannot 326 complete reconfiguration, \fBsyslogd\fR sends a mail message to the superuser 327 on the current system stating that it has shut down, and exits. 328 .sp 329 .LP 330 Care should be taken to ensure that each window displaying messages forwarded 331 by \fBsyslogd\fR (especially console windows) is run in the system default 332 locale (which is \fBsyslogd\fR's locale). If this advice is not followed, it is 333 possible for a \fBsyslog\fR message to alter the terminal settings for that 334 window, possibly even allowing remote execution of arbitrary commands from that 335 window. 336 .sp 337 .LP 338 The \fBsyslogd\fR service is managed by the service management facility, 339 \fBsmf\fR(5), under the service identifier: 340 .sp 341 .in +2 342 .nf 343 svc:/system/system-log:default 344 .fi 345 .in -2 346 .sp 347 348 .sp 349 .LP 350 Administrative actions on this service, such as enabling, disabling, or 351 requesting restart, can be performed using \fBsvcadm\fR(1M). The service's 352 status can be queried using the \fBsvcs\fR(1) command. 353 .sp 354 .LP 355 When \fBsyslogd\fR is started by means of \fBsvcadm\fR(1M), if a value is 356 specified for \fBLOG_FROM_REMOTE\fR in the \fB/etc/defaults/syslogd\fR file, 357 the SMF property \fBsvc:/system/system-log/config/log_from_remote\fR is set to 358 correspond to the \fBLOG_FROM_REMOTE\fR value and the 359 \fB/etc/default/syslogd\fR file is modified to replace the 360 \fBLOG_FROM_REMOTE\fR specification with the following comment: 361 .sp 362 .in +2 363 .nf 364 # LOG_FROM_REMOTE is now set using svccfg(1m), see syslogd(1m). 365 .fi 366 .in -2 367 368 .sp 369 .LP 370 If neither \fBLOG_FROM_REMOTE\fR nor 371 \fBsvc:/system/system-log/config/log_from_remote\fR are defined, the default is 372 to log remote messages. 373 .sp 374 .LP 375 On installation, the initial value of 376 \fBsvc:/system/system-log/config/log_from_remote\fR is \fBfalse\fR.