.\" syslog.conf - syslogd(8) configuration file.\" Copyright (c) 1995  Martin Schulze <Martin.Schulze@Linux.DE>.\" .\" This file is part of the sysklogd package, a kernel and system log daemon..\" .\" This program is free software; you can redistribute it and/or modify.\" it under the terms of the GNU General Public License as published by.\" the Free Software Foundation; either version 2 of the License, or.\" (at your option) any later version..\" .\" This program is distributed in the hope that it will be useful,.\" but WITHOUT ANY WARRANTY; without even the implied warranty of.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the.\" GNU General Public License for more details..\" .\" You should have received a copy of the GNU General Public License.\" along with this program; if not, write to the Free Software.\" Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111, USA..\".TH SYSLOG.CONF 5 "1 January 1998" "Version 1.3" "Linux System Administration".SH NAMEsyslog.conf \- syslogd(8) configuration file.SH DESCRIPTIONThe.I syslog.conffile is the main configuration file for the.BR syslogd (8)which logs system messages on *nix systems.  This file specifies rulesfor logging.  For special features see the.BR sysklogd (8)manpage.Every rule consists of two fields, a .I selectorfield and an.I action field.  These two fields are separated by one or more spaces ortabs.  The selector field specifies a pattern of facilities andpriorities belonging to the specified action.Lines starting with a hash mark (``#'') and empty lines are ignored.This release of.B syslogdis able to understand an extended syntax.  One rule can be dividedinto several lines if the leading line is terminated with an backslash(``\\'')..SH SELECTORSThe selector field itself again consists of two parts, a.I facilityand a .IR priority ,separated by a period (``.'').Both parts are case insensitive and can also be specified as decimalnumbers, but don't do that, you have been warned.  Both facilities andpriorities are described in .BR syslog (3).The names mentioned below correspond to the similar .BR LOG_ -valuesin.IR /usr/include/syslog.h .The.I facilityis one of the following keywords:.BR auth ", " authpriv ", " cron ", " daemon ", " kern ", " lpr ", ".BR mail ", " mark ", " news ", " security " (same as " auth "), ".BR syslog ", " user ", " uucp " and " local0 " through " local7 .The keyword .B securityshould not be used anymore and.B markis only for internal use and therefore should not be used inapplications.  Anyway, you may want to specify and redirect thesemessages here.  The.I facilityspecifies the subsystem that produced the message, i.e. all mailprograms log with the mail facility.BR "" ( LOG_MAIL )if they log using syslog.The.I priorityis one of the following keywords, in ascending order: .BR debug ", " info ", " notice ", " warning ", " warn " (same as ".BR warning "), " err ", " error " (same as " err "), " crit ", ".BR alert ", " emerg ", " panic " (same as " emerg ).The keywords.BR error ", " warn " and " panicare deprecated and should not be used anymore.  The.I prioritydefines the severity of the messageThe behavior of the original BSD syslogd is that all messages of thespecified priority and higher are logged according to the givenaction.  This.BR syslogd (8)behaves the same, but has some extensions.In addition to the above mentioned names the.BR syslogd (8)understands the following extensions: An asterisk (``*'') stands forall facilities or all priorities, depending on where it is used(before or after the period).  The keyword.B nonestands for no priority of the given facility.You can specify multiple facilities with the same priority pattern inone statement using the comma (``,'') operator.  You may specify asmuch facilities as you want.  Remember that only the facility part fromsuch a statement is taken, a priority part would be skipped.Multiple selectors may be specified for a single.I actionusing the semicolon (``;'') separator.  Remember that each selector inthe .I selectorfield is capable to overwrite the preceding ones.  Using thisbehavior you can exclude some priorities from the pattern.This .BR syslogd (8)has a syntax extension to the original BSD source, that makes its usemore intuitively.  You may precede every priority with an equation sign(``='') to specify only this single priority and not any of theabove.  You may also (both is valid, too) precede the priority with anexclamation mark (``!'') to ignore all that priorities, either exactthis one or this and any higher priority.  If you use both extensionsthan the exclamation mark must occur before the equation sign, justuse it intuitively..SH ACTIONSThe action field of a rule describes the abstract term``logfile''.  A ``logfile'' need not to be a real file, btw.  The.BR syslogd (8)provides the following actions..SS Regular FileTypically messages are logged to real files.  The file has to bespecified with full pathname, beginning with a slash ``/''.You may prefix each entry with the minus ``-'' sign to omit syncingthe file after every logging.  Note that you might lose information ifthe system crashes right behind a write attempt.  Nevertheless thismight give you back some performance, especially if you run programsthat use logging in a very verbose manner..SS Named PipesThis version of.BR syslogd (8)has support for logging output  tonamed pipes (fifos).  A fifo or named pipe can be used asa destination for log messages by prepending a pipe symbol (``|'') tothe name of the file.  This is handy for debugging.  Note that the fifomust be created with the  .BR mkfifo (1)command  before.BR syslogd (8)is started..SS Terminal and ConsoleIf the file you specified is a tty, special tty-handling is done, samewith.IR /dev/console ..SS Remote MachineThis .BR syslogd (8)provides full remote logging, i.e. is able to send messages to aremote host running .BR syslogd (8)and to receive messages from remote hosts.  The remotehost won't forward the message again, it will just log themlocally.  To forward messages to another host, prepend the hostnamewith the at sign (``@'').Using this feature you're able to control all syslog messages on onehost, if all other machines will log remotely to that.  This tears downadministration needs..SS List of UsersUsually critical messages are also directed to ``root'' on thatmachine.  You can specify a list of users that shall get the message bysimply writing the login.  You may specify more than one user byseparating them with commas (``,'').  If they're logged in theyget the message.  Don't think a mail would be sent, that might be toolate..SS Everyone logged onEmergency messages often go to all users currently online to notifythem that something strange is happening with the system.  To specifythis.IR wall (1)-featureuse an asterisk (``*'')..SH EXAMPLESHere are some example, partially taken from a real existing site andconfiguration.  Hopefully they rub out all questions to theconfiguration, if not, drop me (Joey) a line..IP.nf# Store critical stuff in critical#*.=crit;kern.none            /var/adm/critical.fi.LPThis will store all messages with the priority.B critin the file.IR /var/adm/critical ,except for any kernel message..IP.nf# Kernel messages are first, stored in the kernel# file, critical messages and higher ones also go# to another host and to the console#kern.*                       /var/adm/kernelkern.crit                    @finlandiakern.crit                    /dev/consolekern.info;kern.!err          /var/adm/kernel-info.fi.LPThe first rule direct any message that has the kernel facility to thefile.IR /var/adm/kernel .The second statement directs all kernel messages of the priority.B critand higher to the remote host finlandia.  This is useful, because ifthe host crashes and the disks get irreparable errors you might not beable to read the stored messages.  If they're on a remote host, too,you still can try to find out the reason for the crash.The third rule directs these messages to the actual console, so theperson who works on the machine will get them, too.The fourth line tells the syslogd to save all kernel messages thatcome with priorities from.BR info " up to " warningin the file.IR /var/adm/kernel-info .Everything from.I errand higher is excluded..IP.nf# The tcp wrapper loggs with mail.info, we display# all the connections on tty12#mail.=info                   /dev/tty12.fi.LPThis directs all messages that uses .BR mail.info " (in source " LOG_MAIL " | " LOG_INFO )to.IR /dev/tty12 , the 12th console.  For example the tcpwrapper.BR tcpd (8)uses this as it's default..IP.nf# Store all mail concerning stuff in a file#mail.*;mail.!=info           /var/adm/mail.fi.LPThis pattern matches all messages that come with the.B mailfacility, except for the.B infopriority.  These will be stored in the file.IR /var/adm/mail ..IP.nf# Log all mail.info and news.info messages to info#mail,news.=info              /var/adm/info.fi.LPThis will extract all messages that come either with.BR mail.info " or with " news.info and store them in the file.IR /var/adm/info ..IP.nf# Log info and notice messages to messages file#*.=info;*.=notice;\\	mail.none  /var/log/messages.fi.LPThis lets the.B syslogdlog all messages that come with either the.BR info " or the " noticefacility into the file.IR /var/log/messages ,except for all messages that use the.B mailfacility..IP.nf# Log info messages to messages file#*.=info;\\	mail,news.none       /var/log/messages.fi.LPThis statement causes the.B syslogdto log all messages that come with the.B infopriority to the file.IR /var/log/messages .But any message coming either with the.BR mail " or the " newsfacility will not be stored..IP.nf# Emergency messages will be displayed using wall#*.=emerg                     *.fi.LPThis rule tells the.B syslogdto write all emergency messages to all currently logged in users.  Thisis the wall action..IP.nf# Messages of the priority alert will be directed# to the operator#*.alert                      root,joey.fi.LPThis rule directs all messages with a priority of.B alertor higher to the terminals of the operator, i.e. of the users ``root''and ``joey'' if they're logged in..IP.nf*.*                          @finlandia.fi.LPThis rule would redirect all messages to a remote host calledfinlandia.  This is useful especially in a cluster of machines whereall syslog messages will be stored on only one machine..SH CONFIGURATION FILE SYNTAX DIFFERENCES.B Syslogduses a slightly different syntax for its configuration file thanthe original BSD sources.  Originally all messages of a specific priorityand above were forwarded to the log file.  The modifiers ``='', ``!''and ``-'' were added to make the.B syslogdmore flexible and to use it in a more intuitive manner.The original BSD syslogd doesn't understand spaces as separators betweenthe selector and the action field..SH FILES.PD 0.TP.I /etc/syslog.confConfiguration file for.B syslogd.SH BUGSThe effects of multiple selectors are sometimes not intuitive.  Forexample ``mail.crit,*.err'' will select ``mail'' facility messages atthe level of ``err'' or higher, not at the level of ``crit'' orhigher..SH SEE ALSO.BR sysklogd (8),.BR klogd (8), .BR logger (1),.BR syslog (2),.BR syslog (3).SH AUTHORSThe.B syslogdis taken from BSD sources, Greg Wettstein (greg@wind.enjellic.com)performed the port to Linux, Martin Schulze (joey@linux.de)made some bugfixes and added some new features.