Tribblix: manual page: syslog.conf.5

SYSLOG.CONF(5) File Formats and Configurations SYSLOG.CONF(5)

NAME

syslog.conf - configuration file for syslogd system log daemon

SYNOPSIS

/etc/syslog.conf

DESCRIPTION

The file /etc/syslog.conf contains information used by the system log
daemon, syslogd(8), to forward a system message to appropriate log
files and/or users. syslogd preprocesses this file through m4(1) to
obtain the correct information for certain log files, defining
LOGHOST if the address of "loghost" is the same as one of the
addresses of the host that is running syslogd.

A configuration entry is composed of two TAB-separated fields:

selector action

The selector field contains a semicolon-separated list of priority
specifications of the form:

facility.level [ ; facility.level ]

where facility is a system facility, or comma-separated list of
facilities, and level is an indication of the severity of the
condition being logged. The presence of a facility name only implies
that it is available. Each individual service determines which
facility it will use for logging. In particular, many facilities are
only useful for syslog messages that are forwarded from other
operating systems. Recognized values for facility include:

kern
Messages generated by the kernel.

user
Messages generated by user processes. This is the default
priority for messages from programs or facilities not
listed in this file.

mail
The mail system.

daemon
Various system daemons.

auth
The authorization system: login(1), su(8), getty(8),
among others.

lpr
The line printer spooling system: lpr(1B), lpc(1B), among
others.

news
Designated for the USENET network news system.

uucp
Designated for the UUCP system; it does not currently use
the syslog mechanism.

altcron
Designated for the BSD cron/at system.

authpriv
Designated for the BSD security/authorization system.

ftp
Designated for the file transfer system.

ntp
Designated for the network time system.

audit
Designated for audit messages generated by systems that
audit by means of syslog.

console
Designated for the BSD console system.

cron
Designated for cron/at messages generated by systems that
do logging through syslog. The current versions of cron
and at do not use this facility for logging.

local0-7
Designated for local use.

mark
For timestamp messages produced internally by syslogd.

*
An asterisk indicates all facilities except for the mark
facility.

Recognized values for level are (in descending order of severity):

emerg
For panic conditions that would normally be broadcast to
all users.

alert
For conditions that should be corrected immediately, such
as a corrupted system database.

crit
For warnings about critical conditions, such as hard
device errors.

err
For other errors.

warning
For warning messages.

notice
For conditions that are not error conditions, but may
require special handling. A configuration entry with a
level value of notice must appear on a separate line.

info
Informational messages.

debug
For messages that are normally used only when debugging a
program.

none
Do not send messages from the indicated facility to the
selected file. For example, a selector of

*.debug;mail.none

sends all messages except mail messages to the selected
file.

For a given facility and level, syslogd matches all messages for that
level and all higher levels. For example, an entry that specifies a
level of crit also logs messages at the alert and emerg levels.

The action field indicates where to forward the message. Values for
this field can have one of four forms:

o A filename, beginning with a leading slash, which
indicates that messages specified by the selector are to
be written to the specified file. The file is opened in
append mode if it exists. If the file does not exist,
logging silently fails for this action.

o The name of a remote host, prefixed with an @, as with:
@server, which indicates that messages specified by the
selector are to be forwarded to the syslogd on the named
host. The hostname "loghost" is treated, in the default
syslog.conf, as the hostname given to the machine that
logs syslogd messages. Every machine is "loghost" by
default, per the hosts database. It is also possible to
specify one machine on a network to be "loghost" by,
literally, naming the machine "loghost". If the local
machine is designated to be "loghost", then syslogd
messages are written to the appropriate files. Otherwise,
they are sent to the machine "loghost" on the network.

o A comma-separated list of usernames, which indicates that
messages specified by the selector are to be written to
the named users if they are logged in.

o An asterisk, which indicates that messages specified by
the selector are to be written to all logged-in users.

Blank lines are ignored. Lines for which the first nonwhite character
is a '#' are treated as comments.

EXAMPLES

Example 1: A Sample Configuration File

With the following configuration file:

*.notice /var/log/notice
mail.info /var/log/notice
*.crit /var/log/critical
kern,mark.debug /dev/console
kern.err @server
*.emerg *
*.alert root,operator
*.alert;auth.warning /var/log/auth

syslogd(8) logs all mail system messages except debug messages and
all notice (or higher) messages into a file named /var/log/notice.
It logs all critical messages into /var/log/critical, and all kernel
messages and 20-minute marks onto the system console.

Kernel messages of err (error) severity or higher are forwarded to
the machine named server. Emergency messages are forwarded to all
users. The users root and operator are informed of any alert
messages. All messages from the authorization system of warning
level or higher are logged in the file /var/log/auth.