|
NAMEsyslog.conf —
syslogd(8)
configuration file
DESCRIPTIONThesyslog.conf file is the configuration file for the
syslogd(8)
program. It consists of blocks of lines separated by
program, hostname or
property-based filter specifications (separations appear
alone on their lines), with each line containing two fields: the
selector field which specifies the types of messages and
priorities to which the line applies, and an action field
which specifies the action to be taken if a message
syslogd(8)
receives matches the selection criteria. The selector field
is separated from the action field by one or more tab
characters or spaces.
A special include keyword can be used to include all files with names ending in '.conf' and not beginning with a '.' contained in the directory following the keyword. This keyword can only be used in the first level configuration file. Note that if you use spaces as separators, your
The selectors are encoded as a facility, a period (“.”), an optional set of comparison flags ([!] [<=>]), and a level, with no intervening white-space. Both the facility and the level are case insensitive. The facility describes the part of the system
generating the message, and is one of the following keywords:
The comparison flags may be used to specify
exactly what is logged. The default comparison is “=>” (or,
if you prefer, “>=”), which means that messages from the
specified facility list, and of a priority level equal to
or greater than level will be logged. Comparison flags
beginning with “ The level describes the severity of the message,
and is a keyword from the following ordered list (higher to lower):
Each block of lines is separated from the previous block by a
program, hostname or
property-based filter specification. A block will only log
messages corresponding to the most recent program,
hostname and property-based filter
specifications given. Thus, with a block which selects
‘ A program specification is a line beginning with
‘ A hostname specification of the form
‘ A property-based filter specification is a line
beginning with ‘ A program, hostname or
property-based filter specification may be reset by giving
‘ See syslog(3) for further descriptions of both the facility and level keywords and their significance. It is preferred that selections be made on facility rather than program, since the latter can easily vary in a networked environment. In some cases, though, an appropriate facility simply does not exist. If a received message matches the specified facility and is of the specified level (or a higher level), and the first word in the message after the date matches the program, the action specified in the action field will be taken. Multiple selectors may be specified for a single action by separating them with semicolon (“;”) characters. It is important to note, however, that each selector can modify the ones preceding it. Multiple facilities may be specified for a single level by separating them with comma (“,”) characters. An asterisk (“*”) can be used to specify all facilities, all levels, or all programs. The special facility “mark” receives a message at priority “info” every 20 minutes (see syslogd(8)). This is not enabled by a facility field containing an asterisk. The special level “none” disables a particular facility. The action field of each line specifies the action to be taken when the selector field selects a message. There are five forms:
Blank lines and lines whose first non-blank character is a hash
(“#”) character are ignored. If
‘ PROPERTY-BASED FILTERSprogram, hostname specifications performs exact match filtering against explicit field only. Property-based filters feature substring and regular expressions (see re_format(7)) matching against various message attributes. Filter specification starts with ‘#: ’ or
‘: ’ followed by three comma-separated
fields property, operator,
"value". Value must be double-quoted. A double
quote and backslash must be escaped by a backslash.
Following properties are supported as test value:
Operator specifies a comparison function between
propertie's
Operator may be prefixed by
IMPLEMENTATION NOTESThe “kern” facility is usually reserved for messages generated by the local kernel. Other messages logged with facility “kern” are usually translated to facility “user”. This translation can be disabled; see syslogd(8) for details.FILES
EXAMPLESA configuration file might appear as follows:# Log all kernel messages, authentication messages of # level notice or higher, and anything of level err or # higher to the console. # Do not log private authentication messages! *.err;kern.*;auth.notice;authpriv.none;mail.crit /dev/console # Log anything (except mail) of level info or higher. # Do not log private authentication messages! *.info;mail.none;authpriv.none /var/log/messages # Log daemon messages at debug level only daemon.=debug /var/log/daemon.debug # The authpriv file has restricted access. authpriv.* /var/log/secure # Log all the mail messages in one place. mail.* /var/log/maillog # Everybody gets emergency messages, plus log them on another # machine. *.emerg * *.emerg @arpa.berkeley.edu # Root and Eric get alert and higher messages. *.alert root,eric # Save mail and news errors of level err and higher in a # special file. uucp,news.crit /var/log/spoolerr # Pipe all authentication messages to a filter. auth.* |exec /usr/local/sbin/authfilter # Log all security messages to a separate file. security.* /var/log/security # Log all writes to /dev/console to a separate file. console.* /var/log/console.log # Save ftpd transactions along with mail and news !ftpd *.* /var/log/spoolerr # Log ipfw messages without syncing after every message. !ipfw *.* -/var/log/ipfw # Log ipfw messages with "Deny" in the message body. :msg, contains, ".*Deny.*" *.* /var/log/ipfw.deny # Reset program name filtering !* # Log messages from bird or bird6 into one file :programname, regex, "^bird6?$" *.* /var/log/bird-all.log # Log messages from servers in racks 10-19 in multiple locations, case insensitive :hostname, icase_ereregex, "^server-(dcA|podB|cdn)-rack1[0-9]{2}\..*" *.* /var/log/racks10..19.log SEE ALSOsyslog(3), syslogd(8)BUGSThe effects of multiple selectors are sometimes not intuitive. For example “mail.crit,*.err” will select “mail” facility messages at the level of “err” or higher, not at the level of “crit” or higher.In networked environments, note that not all operating systems implement the same set of facilities. The facilities authpriv, cron, ftp, and ntp that are known to this implementation might be absent on the target system. Even worse, DEC UNIX uses facility number 10 (which is authpriv in this implementation) to log events for their AdvFS file system.
Visit the GSP FreeBSD Man Page Interface. |