1 .\" syslog.conf - syslogd(8) configuration file
2 .\" Copyright (c) 1995-2009 Martin Schulze <joey@infodrom.org>
4 .\" This file is part of the sysklogd package, a kernel and system log daemon.
6 .\" This program is free software; you can redistribute it and/or modify
7 .\" it under the terms of the GNU General Public License as published by
8 .\" the Free Software Foundation; either version 2 of the License, or
9 .\" (at your option) any later version.
11 .\" This program is distributed in the hope that it will be useful,
12 .\" but WITHOUT ANY WARRANTY; without even the implied warranty of
13 .\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 .\" GNU General Public License for more details.
16 .\" You should have received a copy of the GNU General Public License
17 .\" along with this program; if not, write to the Free Software
18 .\" Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111, USA.
20 .TH SYSLOG.CONF 5 "27 November 2009" "Version 1.5" "Linux System Administration"
22 syslog.conf \- syslogd(8) configuration file
26 file is the main configuration file for
28 which logs system messages on *nix systems. This file specifies rules
29 for logging. For special features see the
33 Every rule consists of two fields, a
37 field. These two fields are separated by one or more spaces or
38 tabs. The selector field specifies a pattern of facilities and
39 priorities belonging to the specified action.
41 Lines starting with a hash mark (``#'') and empty lines are ignored.
45 is able to understand a slightly extended syntax compared to the
47 One rule may be divided
48 into several lines if the leading line is terminated with an backslash
51 The selector field consists of two parts, a
55 separated by a period (``.'').
56 Both parts are case insensitive and can also be specified as decimal
57 numbers corresponding to the definitions in
58 .IR /usr/include/syslog.h .
59 It is safer to use symbolic names rather than decimal numbers.
60 Both facilities and priorities are described in
62 The names mentioned below correspond to the similar
65 .IR /usr/include/syslog.h .
69 is one of the following keywords:
70 .BR auth ", " authpriv ", " cron ", " daemon ", " ftp ", " kern ", " lpr ", "
71 .BR mail ", " mark ", " news ", " security " (same as " auth "), "
72 .BR syslog ", " user ", " uucp " and " local0 " through " local7 .
77 is only for internal use and therefore should not be used in
80 specifies the subsystem that produced the message, e.g. all mail
81 programs log with the mail facility
83 if they log using syslog.
85 In most cases anyone can log to any facility, so we rely on convention
86 for the correct facility to be chosen. However, generally only the
87 kernel can log to the "kern" facility. This is because the implementation
88 of openlog() and syslog() in glibc does not allow logging to the "kern"
89 facility. Klogd circumvents this restriction when logging to syslogd
90 by reimplementing those functions itself.
94 is one of the following keywords, in ascending order:
95 .BR debug ", " info ", " notice ", " warning ", " warn " (same as "
96 .BR warning "), " err ", " error " (same as " err "), " crit ", "
97 .BR alert ", " emerg ", " panic " (same as " emerg ).
99 .BR warn ", " error " and " panic
100 are deprecated and should not be used anymore. The
102 defines the severity of the message
104 The behavior of the original BSD syslogd is that all messages of the
105 specified priority and higher are logged according to the given
108 behaves the same, but has some extensions.
110 In addition to the above mentioned names the
112 understands the following extensions: An asterisk (``*'') stands for
113 all facilities or all priorities, depending on where it is used
114 (before or after the period). The keyword
116 stands for no priority of the given facility.
118 Multiple facilities may be specified for a single priority pattern in
119 one statement using the comma (``,'') operator to separate the
120 facilities. You may specify as many facilities as you want.
121 Please note that only the facility part from
122 such a statement is taken, a priority part would be ignored.
124 Multiple selectors may be specified for a single
126 using the semicolon (``;'') separator. Selectors are processed from
127 left to right, with each selector being able to overwrite preceding ones.
128 Using this behavior you are able to exclude some priorities from the pattern.
132 has a syntax extension to the original BSD source, which makes its use
133 more intuitive. You may precede every priority with an equation sign
134 (``='') to specify that
136 should only refer to this single priority and not this priority and
137 all higher priorities.
139 You may also precide the priority with an exclamation mark (``!'') if
142 to ignore this priority and all higher priorities.
143 You may even use both, the exclamation mark and the equation sign if
146 to ignore only this single priority. If you use both extensions
147 than the exclamation mark must occur before the equation sign, just
150 The action field of a rule describes the abstract term
151 ``logfile''. A ``logfile'' need not to be a real file, btw. The
153 provides the following actions.
156 Typically messages are logged to real files.
157 The filename is specified with an absolute pathname.
159 You may prefix each entry with a minus sign (``-'') to avoid syncing
160 the file after each log message. Note that you might lose information if
161 the system crashes right after a write attempt. Nevertheless this
162 might give you back some performance, especially if you run programs
163 that use logging in a very verbose manner.
168 has support for logging output to
169 named pipes (fifos). A fifo or named pipe can be used as
170 a destination for log messages by prepending a pipe symbol (``|'') to
171 the name of the file. This is handy for debugging. Note that the fifo
172 must be created with the
178 .SS Terminal and Console
179 If the file you specified is a tty, special tty-handling is done, same
186 provides full remote logging, i.e. is able to send messages to a
189 and to receive messages from remote hosts. The remote
190 host won't forward the message again, it will just log them
191 locally. To forward messages to another host, prepend the hostname
192 with the at sign (``@'').
194 Using this feature you are able to collect all syslog messages on a
195 central host, if all other machines log remotely to that one. This
196 reduces administration needs.
198 Using a named pipe log method, messages from remote hosts can be sent
199 to a log program. By reading log messages line by line such a program
200 is able to sort log messages by host name or program name on the
201 central log host. This way it is possible to split the log into
205 Usually critical messages are also directed to ``root'' on that
206 machine. You can specify a list of users that ought to receive the
207 log message on the terminal by writing their usernames.
208 You may specify more than one user by
209 separating the usernames with commas (``,''). If they're logged in they
210 will receive the log messages.
212 .SS Everyone logged on
213 Emergency messages often go to all users currently online to notify
214 them that something strange is happening with the system. To specify
217 use an asterisk (``*'').
219 Here are some examples, partially taken from a real existing site and
220 configuration. Hopefully they answer all questions about
223 If not, don't hesitate to contact the mailing list.
226 # Store critical stuff in critical
228 *.=crit;kern.none /var/adm/critical
231 This will store all messages of priority
234 .IR /var/adm/critical ,
235 with the exception of any kernel messages.
239 # Kernel messages are stored in the kernel file,
240 # critical messages and higher ones also go
241 # to another host and to the console
243 kern.* /var/adm/kernel
245 kern.crit /dev/console
246 kern.info;kern.!err /var/adm/kernel-info
249 The first rule directs any message that has the kernel facility to the
251 .IR /var/adm/kernel .
252 (But recall that only the kernel itself can log to this facility.)
254 The second statement directs all kernel messages of priority
256 and higher to the remote host finlandia. This is useful, because if
257 the host crashes and the disks get irreparable errors you might not be
258 able to read the stored messages. If they're on a remote host, too,
259 you still can try to find out the reason for the crash.
261 The third rule directs kernel messages of priority crit and higher to
262 the actual console, so the person who works on the machine will get
265 The fourth line tells the syslogd to save all kernel messages that
266 come with priorities from
267 .BR info " up to " warning
269 .IR /var/adm/kernel-info .
271 This is an example of the 2nd selector overwriting part of the first
272 one. The first selector selects kernel messages of priority
274 and higher. The second selector filters out kernel messages of
277 and higher. This leaves just priorities
278 .BR info ", " notice " and " warning
283 # The tcp wrapper logs with mail.info, we display
284 # all the connections on tty12
286 mail.=info /dev/tty12
289 This directs all messages that use
290 .BR mail.info " (in source " LOG_MAIL " | " LOG_INFO )
293 the 12th console. For example the tcpwrapper
295 uses this as its default.
299 # Write all mail related logs to a file
301 mail.*;mail.!=info /var/adm/mail
304 This pattern matches all messages that come with the
306 facility, except for the
308 priority. These will be stored in the file
313 # Log all mail.info and news.info messages to info
315 mail,news.=info /var/adm/info
318 This will extract all messages that come either with
319 .BR mail.info " or with " news.info
320 and store them in the file
325 # Log info and notice messages to messages file
328 mail.none /var/log/messages
333 log all messages that come with either the
334 .BR info " or the " notice
335 priority into the file
336 .IR /var/log/messages ,
337 except for all messages that use the
343 # Log info messages to messages file
346 mail,news.none /var/log/messages
349 This statement causes the
351 to log all messages that come with the
354 .IR /var/log/messages .
355 But any message coming either with the
356 .BR mail " or the " news
357 facility will not be stored.
361 # Emergency messages will be displayed using wall
368 to write all emergency messages to all currently logged in users. This
373 # Messages of the priority alert will be directed
379 This rule directs all messages of priority
381 or higher to the terminals of the operator, i.e. of the users ``root''
382 and ``joey'' if they're logged in.
389 This rule would redirect all messages to a remote host called
390 finlandia. This is useful especially in a cluster of machines where
391 all syslog messages will be stored on only one machine.
392 .SH CONFIGURATION FILE SYNTAX DIFFERENCES
394 uses a slightly different syntax for its configuration file than
395 the original BSD sources. Originally all messages of a specific priority
396 and above were forwarded to the log file. The modifiers ``='', ``!''
397 and ``-'' were added to make the
399 more flexible and to use it in a more intuitive manner.
401 The original BSD syslogd doesn't understand spaces as separators between
402 the selector and the action field.
407 Configuration file for
410 The effects of multiple selectors are sometimes not intuitive. For
411 example ``mail.crit,*.err'' will select ``mail'' facility messages at
412 the level of ``err'' or higher, not at the level of ``crit'' or
415 Also, if you specify a selector with an exclamation mark in it
416 which isn't preceded by a corresponding selector without an
417 exclamation mark, nothing will be logged. Intuitively, the
418 selector ``ftp.!alert'' on its own will select all ftp messages
419 with priorities less than alert. In fact it selects nothing.
420 Similarly ``ftp.!=alert'' might reasonably be expected to select
421 all ftp messages other than those with priority alert, but again
422 it selects nothing. It seems the selectors with exclamation
423 marks in them should only be used as `filters' following
424 selectors without exclamation marks.
426 Finally, using a backslash to divide a line into two doesn't
427 work if the backslash is used immediately after the end of the
428 selector, without intermediate whitespace.
439 is taken from BSD sources, Greg Wettstein <greg@wind.enjellic.com>
440 performed the port to Linux, Martin Schulze <joey@infodrom.org>
441 fixed some bugs, added several new features and took over maintenance.
projects / infodrom / sysklogd / blob