4.4BSD/usr/share/man/cat5/syslog.conf.0

SYSLOG.CONF(5)              BSD Programmer's Manual             SYSLOG.CONF(5)

NNAAMMEE
     ssyysslloogg..ccoonnff - syslogd(8) configuration file

DDEESSCCRRIIPPTTIIOONN
     The ssyysslloogg..ccoonnff file is the configuration file for the syslogd(8) pro-
     gram.  It consists of lines with two fields: the _s_e_l_e_c_t_o_r field which
     specifies the types of messages and priorities to which the line applies,
     and an _a_c_t_i_o_n field which specifies the action to be taken if a message
     syslogd receives matches the selection criteria.  The _s_e_l_e_c_t_o_r field is
     separated from the _a_c_t_i_o_n field by one or more tab characters.

     The _S_e_l_e_c_t_o_r_s function are encoded as a _f_a_c_i_l_i_t_y, a period (``.''), and a
     _l_e_v_e_l, with no intervening white-space.  Both the _f_a_c_i_l_i_t_y and the _l_e_v_e_l
     are case insensitive.

     The _f_a_c_i_l_i_t_y describes the part of the system generating the message, and
     is one of the following keywords: auth, authpriv, cron, daemon, kern,
     lpr, mail, mark, news, syslog, user, uucp and local0 through local7.
     These keywords (with the exception of mark) correspond to the similar
     ``LOG_'' values specified to the openlog(3) and syslog(3) library rou-
     tines.

     The _l_e_v_e_l describes the severity of the message, and is a keyword from
     the following ordered list (higher to lower): emerg, alert, crit, err,
     warning, notice and debug.  These keywords correspond to the similar
     (LOG_) values specified to the syslog library routine.

     See syslog(3) for a further descriptions of both the _f_a_c_i_l_i_t_y and _l_e_v_e_l
     keywords and their significance.

     If a received message matches the specified _f_a_c_i_l_i_t_y and is of the speci-
     fied _l_e_v_e_l _(_o_r _a _h_i_g_h_e_r _l_e_v_e_l_), the action specified in the _a_c_t_i_o_n field
     will be taken.

     Multiple _s_e_l_e_c_t_o_r_s may be specified for a single _a_c_t_i_o_n by separating
     them with semicolon (``;'') characters.  It is important to note, howev-
     er, that each _s_e_l_e_c_t_o_r can modify the ones preceding it.

     Multiple _f_a_c_i_l_i_t_i_e_s may be specified for a single _l_e_v_e_l by separating
     them with comma (``,'') characters.

     An asterisk (``*'') can be used to specify all _f_a_c_i_l_i_t_i_e_s or all _l_e_v_e_l_s.

     The special _f_a_c_i_l_i_t_y ``mark'' receives a message at priority ``info'' ev-
     ery 20 minutes (see syslogd(8)).  This is not enabled by a _f_a_c_i_l_i_t_y field
     containing an asterisk.

     The special _l_e_v_e_l ``none'' disables a particular _f_a_c_i_l_i_t_y.

     The _a_c_t_i_o_n field of each line specifies the action to be taken when the
     _s_e_l_e_c_t_o_r field selects a message.  There are four forms:

     ++oo   A pathname (beginning with a leading slash).  Selected messages are
         appended to the file.

     ++oo   A hostname (preceded by an at (``@'') sign).  Selected messages are
         forwarded to the syslogd program on the named host.

     ++oo   A comma separated list of users.  Selected messages are written to
         those users if they are logged in.

     ++oo   An asterisk.  Selected messages are written to all logged-in users.


     Blank lines and lines whose first non-blank character is a hash (``#'')
     character are ignored.

EEXXAAMMPPLLEESS
     A configuration file might appear as follows:

     # Log all kernel messages, authentication messages of
     # level notice or higher and anything of level err or
     # higher to the console.
     # Don't log private authentication messages!
     *.err;kern.*;auth.notice;authpriv.none  /dev/console

     # Log anything (except mail) of level info or higher.
     # Don't log private authentication messages!
     *.info;mail.none;authpriv.none          /var/log/messages

     # The authpriv file has restricted access.
     authpriv.*                                              /var/log/secure

     # Log all the mail messages in one place.
     mail.*                                                  /var/log/maillog

     # Everybody gets emergency messages, plus log them on another
     # machine.
     *.emerg                                                 *
     *.emerg                                                 @arpa.berkeley.edu

     # Root and Eric get alert and higher messages.
     *.alert                                                 root,eric

     # Save mail and news errors of level err and higher in a
     # special file.
     uucp,news.crit                                          /var/log/spoolerr

FFIILLEESS
     /etc/syslog.conf  The syslogd(8) configuration file.

BBUUGGSS
     The effects of multiple selectors are sometimes not intuitive.  For exam-
     ple ``mail.crit,*.err'' will select ``mail'' facility messages at the
     level of ``err'' or higher, not at the level of ``crit'' or higher.

SSEEEE AALLSSOO
     syslog(3),  syslogd(8)

4.4BSD                           June 9, 1993                                2