1.\" Copyright (c) 1990, 1991, 1993 2.\" The Regents of the University of California. All rights reserved. 3.\" 4.\" Redistribution and use in source and binary forms, with or without 5.\" modification, are permitted provided that the following conditions 6.\" are met: 7.\" 1. Redistributions of source code must retain the above copyright 8.\" notice, this list of conditions and the following disclaimer. 9.\" 2. Redistributions in binary form must reproduce the above copyright 10.\" notice, this list of conditions and the following disclaimer in the 11.\" documentation and/or other materials provided with the distribution. 12.\" 3. Neither the name of the University nor the names of its contributors 13.\" may be used to endorse or promote products derived from this software 14.\" without specific prior written permission. 15.\" 16.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 17.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 20.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 21.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 22.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 23.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 24.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 25.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26.\" SUCH DAMAGE. 27.\" 28.Dd March 8, 2026 29.Dt SYSLOG.CONF 5 30.Os 31.Sh NAME 32.Nm syslog.conf 33.Nd syslogd system message log configuration file 34.Sh DESCRIPTION 35The 36.Nm 37file is the configuration file for the 38.Xr syslogd 8 39program. 40It consists of 41blocks of lines separated by 42.Em program , 43.Em hostname 44or 45.Em property-based filter 46specifications (separations appear alone on their lines), 47with each line containing two fields: the 48.Em selector 49field which specifies the types of messages and priorities to which the 50line applies, and an 51.Em action 52field which specifies the action to be taken if a message 53.Xr syslogd 8 54receives matches the selection criteria. 55The 56.Em selector 57field is separated from the 58.Em action 59field by one or more tab characters or spaces. 60.Pp 61A special 62.Em include 63keyword can be used to include all files with names ending in '.conf' and not 64beginning with a '.' contained in the directory following the keyword. 65This keyword can only be used in the first level configuration file. 66.Pp 67Note that if you use spaces as separators, your 68.Nm 69might be incompatible with other Unices or Unix-like systems. 70This functionality was added for ease of configuration 71(e.g.,\& it is possible to cut-and-paste into 72.Nm ) , 73and to avoid possible mistakes. 74This change however preserves 75backwards compatibility with the old style of 76.Nm 77(i.e., tab characters only). 78.Pp 79The 80.Em selectors 81are encoded as a 82.Em facility , 83a period 84.Pq Dq \&. , 85an optional set of comparison flags 86.Pq Oo \&! Oc Op <=> , 87and a 88.Em level , 89with no intervening white-space. 90Both the 91.Em facility 92and the 93.Em level 94are case insensitive. 95.Pp 96The 97.Em facility 98describes the part of the system generating the message, and is one of 99the following keywords: 100.Cm auth , authpriv , console , cron , daemon , ftp , kern , lpr , 101.Cm mail , mark , news , ntp , security , syslog , user , uucp , 102and 103.Cm local0 104through 105.Cm local7 . 106These keywords (with the exception of mark) correspond to 107similar 108.Dq Dv LOG_ 109values specified to the 110.Xr openlog 3 111and 112.Xr syslog 3 113library routines. 114.Pp 115The 116.Em comparison flags 117may be used to specify exactly what is logged. 118The default comparison is 119.Dq => 120(or, if you prefer, 121.Dq >= ) , 122which means that messages from the specified 123.Em facility 124list, and of a priority 125level equal to or greater than 126.Em level 127will be logged. 128Comparison flags beginning with 129.Dq Li \&! 130will have their logical sense inverted. 131Thus 132.Dq !=info 133means all levels except info and 134.Dq !notice 135has the same meaning as 136.Dq <notice . 137.Pp 138The 139.Em level 140describes the severity of the message, and is a keyword from the 141following ordered list (higher to lower): 142.Cm emerg , alert , crit , err , warning , notice , info 143and 144.Cm debug . 145These keywords correspond to 146similar 147.Dq Dv LOG_ 148values specified to the 149.Xr syslog 3 150library routine. 151.Pp 152Each block of lines is separated from the previous block by a 153.Em program , 154.Em hostname 155or 156.Em property-based filter 157specification. 158A block will only log messages corresponding to the most recent 159.Em program , 160.Em hostname 161and 162.Em property-based filter 163specifications given. 164Thus, with a block which selects 165.Ql ppp 166as the 167.Em program , 168directly followed by a block that selects messages from the 169.Em hostname 170.Ql dialhost , 171the second block will only log messages 172from the 173.Xr ppp 8 174program on dialhost. 175.Pp 176A 177.Em program 178specification is a line beginning with 179.Ql #!prog 180or 181.Ql !prog 182(the former is for compatibility with the previous syslogd, if one is sharing 183.Nm 184files, for example) 185and the following blocks will be associated with calls to 186.Xr syslog 3 187from that specific program. 188A 189.Em program 190specification for 191.Ql foo 192will also match any message logged by the kernel with the prefix 193.Ql "foo: " . 194The 195.Ql #!+prog 196or 197.Ql !+prog 198specification works just like the previous one, 199and the 200.Ql #!-prog 201or 202.Ql !-prog 203specification will match any message but the ones from that 204program. 205Multiple programs may be listed, separated by commas: 206.Ql !prog1,prog2 207matches messages from either program, while 208.Ql !-prog1,prog2 209matches all messages but those from 210.Ql prog1 211or 212.Ql prog2 . 213.Pp 214A 215.Em hostname 216specification of the form 217.Ql #+hostname 218or 219.Ql +hostname 220means the following blocks will be applied to messages 221received from the specified hostname. 222Alternatively, the 223.Em hostname 224specification 225.Ql #-hostname 226or 227.Ql -hostname 228causes the following blocks to be applied to messages 229from any host but the one specified. 230If the hostname is given as 231.Ql @ , 232the local hostname will be used. 233As for program specifications, multiple comma-separated 234values may be specified for hostname specifications. 235.Pp 236A 237.Em property-based filter 238specification is a line beginning with 239.Ql #: 240or 241.Ql \&: 242and the following blocks will be applied only when filter value 243matches given filter propertie's value. 244See 245.Sx PROPERTY-BASED FILTERS 246section for more details. 247.Pp 248A 249.Em program , 250.Em hostname 251or 252.Em property-based filter 253specification may be reset by giving 254.Ql * 255as an argument. 256.Pp 257See 258.Xr syslog 3 259for further descriptions of both the 260.Em facility 261and 262.Em level 263keywords and their significance. 264It is preferred that selections be made on 265.Em facility 266rather than 267.Em program , 268since the latter can easily vary in a networked environment. 269In some cases, 270though, an appropriate 271.Em facility 272simply does not exist. 273.Pp 274If a received message matches the specified 275.Em facility 276and is of the specified 277.Em level 278.Em (or a higher level) , 279and the first word in the message after the date matches the 280.Em program , 281the action specified in the 282.Em action 283field will be taken. 284.Pp 285Multiple 286.Em selectors 287may be specified for a single 288.Em action 289by separating them with semicolon 290.Pq Dq \&; 291characters. 292It is important to note, however, that each 293.Em selector 294can modify the ones preceding it. 295.Pp 296Multiple 297.Em facilities 298may be specified for a single 299.Em level 300by separating them with comma 301.Pq Dq \&, 302characters. 303.Pp 304An asterisk 305.Pq Dq * 306can be used to specify all 307.Em facilities , 308all 309.Em levels , 310or all 311.Em programs . 312.Pp 313The special 314.Em facility 315.Dq mark 316receives a message at priority 317.Dq info 318every 20 minutes 319(see 320.Xr syslogd 8 ) . 321This is not enabled by a 322.Em facility 323field containing an asterisk. 324.Pp 325The special 326.Em level 327.Dq none 328disables a particular 329.Em facility . 330.Pp 331The 332.Em action 333field of each line specifies the action to be taken when the 334.Em selector 335field selects a message. 336There are five forms: 337.Bl -bullet 338.It 339A pathname (beginning with a leading slash). 340Selected messages are appended to the file. 341.Pp 342To ensure that kernel messages are written to disk promptly, 343.Nm 344calls 345.Xr fsync 2 346after writing messages from the kernel. 347Other messages are not synced explicitly. 348You may prefix a pathname with the minus sign, 349.Dq - , 350to forego syncing the specified file after every kernel message. 351Note that you might lose information if the system crashes 352immediately following a write attempt. 353Nevertheless, using the 354.Dq - 355option may improve performance, 356especially if the kernel is logging many messages. 357.It 358A hostname (preceded by an at 359.Pq Dq @ 360sign). 361Selected messages are forwarded to the 362.Xr syslogd 8 363program on the named host. 364If a port number is added after a colon 365.Pq Ql :\& 366then that port will be used as the destination port 367rather than the usual syslog port. 368IPv6 addresses can be used 369by surrounding the address portion with 370square brackets 371.Po 372.Ql [\& 373and 374.Ql ]\& 375.Pc . 376.It 377A comma separated list of users. 378Selected messages are written to those users 379if they are logged in. 380.It 381An asterisk. 382Selected messages are written to all logged-in users. 383.It 384A vertical bar 385.Pq Dq \&| , 386followed by a command to pipe the selected 387messages to. 388The command is passed to 389.Xr sh 1 390for evaluation, so usual shell metacharacters or input/output 391redirection can occur. 392(Note however that redirecting 393.Xr stdio 3 394buffered output from the invoked command can cause additional delays, 395or even lost output data in case a logging subprocess exited with a 396signal.) 397The command itself runs with 398.Em stdout 399and 400.Em stderr 401redirected to 402.Pa /dev/null . 403Upon receipt of a 404.Dv SIGHUP , 405.Xr syslogd 8 406will close the pipe to the process. 407If the process did not exit 408voluntarily, it will be sent a 409.Dv SIGTERM 410signal after a grace period of up to 60 seconds. 411.Pp 412The command will only be started once data arrives that should be piped 413to it. 414If it exited later, it will be restarted as necessary. 415So if it 416is desired that the subprocess should get exactly one line of input only 417(which can be very resource-consuming if there are a lot of messages 418flowing quickly), this can be achieved by exiting after just one line of 419input. 420If necessary, a script wrapper can be written to this effect. 421.Pp 422Unless the command is a full pipeline, it is probably useful to 423start the command with 424.Em exec 425so that the invoking shell process does not wait for the command to 426complete. 427Warning: the process is started under the UID invoking 428.Xr syslogd 8 , 429normally the superuser. 430.El 431.Pp 432Blank lines and lines whose first non-blank character is a hash 433.Pq Dq # 434character are ignored. 435If 436.Ql # 437is placed in the middle of the line, the 438.Ql # 439character and the rest of the line after it is ignored. 440To prevent special meaning, the 441.Ql # 442character may be escaped with 443.Ql \e ; 444in this case preceding 445.Ql \e 446is removed and 447.Ql # 448is treated as an ordinary character. 449.Sh PROPERTY-BASED FILTERS 450.Em program , 451.Em hostname 452specifications performs exact match filtering against explicit field only. 453.Em Property-based filters 454feature substring and regular expressions (see 455.Xr re_format 7 ) 456matching against various message attributes. 457Filter specification starts with 458.Ql #: 459or 460.Ql \&: 461followed by three comma-separated fields 462.Em property , operator , \&"value\&" . 463Value must be double-quoted. 464A double quote and backslash must be escaped by a backslash. 465.Pp 466Following 467.Em properties 468are supported as test value: 469.Pp 470.Bl -bullet -compact 471.It 472.Ql msg 473- body of the message received. 474.It 475.Ql programname 476- program name sent the message 477.It 478.Ql hostname 479- hostname of message's originator 480.It 481.Ql source 482- an alias for hostname 483.El 484.Pp 485Operator specifies a comparison function between 486.Em propertie's 487 value against filter's value. 488Possible operators: 489.Pp 490.Bl -bullet -compact 491.It 492.Ql contains 493- true if filter value is found as a substring of 494.Em property 495.It 496.Ql isequal 497- true if filter value is equal to 498.Em property 499.It 500.Ql startswith 501- true if property starts with filter value 502.It 503.Ql regex 504- true if property matches basic regular expression defined in filter value 505.It 506.Ql ereregex 507- true if property matches extended regular expression defined in filter value 508.El 509.Pp 510Operator may be prefixed by 511.Pp 512.Bl -bullet -compact 513.It 514.Ql \&! 515- to invert compare logic 516.It 517.Ql icase_ 518- to make comparison function case insensitive 519.El 520.Sh IMPLEMENTATION NOTES 521The 522.Dq kern 523facility is usually reserved for messages 524generated by the local kernel. 525Other messages logged with facility 526.Dq kern 527are usually translated to facility 528.Dq user . 529This translation can be disabled; 530see 531.Xr syslogd 8 532for details. 533.Sh FILES 534.Bl -tag -width /etc/syslog.conf -compact 535.It Pa /etc/syslog.conf 536.Xr syslogd 8 537configuration file 538.El 539.Sh EXAMPLES 540A configuration file might appear as follows: 541.Bd -literal 542# Log all kernel messages, authentication messages of 543# level notice or higher, and anything of level err or 544# higher to the console. 545# Do not log private authentication messages! 546*.err;kern.*;auth.notice;authpriv.none;mail.crit /dev/console 547 548# Log anything (except mail) of level info or higher. 549# Do not log private authentication messages! 550*.info;mail.none;authpriv.none /var/log/messages 551 552# Log daemon messages at debug level only 553daemon.=debug /var/log/daemon.debug 554 555# The authpriv file has restricted access. 556authpriv.* /var/log/secure 557 558# Log all the mail messages in one place. 559mail.* /var/log/maillog 560 561# Everybody gets emergency messages, plus log them on another 562# machine. 563*.emerg * 564*.emerg @arpa.berkeley.edu 565 566# Root and Eric get alert and higher messages. 567*.alert root,eric 568 569# Save mail and news errors of level err and higher in a 570# special file. 571uucp,news.crit /var/log/spoolerr 572 573# Pipe all authentication messages to a filter. 574auth.* |exec /usr/local/sbin/authfilter 575 576# Log all security messages to a separate file. 577security.* /var/log/security 578 579# Log all writes to /dev/console to a separate file. 580console.* /var/log/console.log 581 582# Save ftpd transactions along with mail and news 583!ftpd 584*.* /var/log/spoolerr 585 586# Log ipfw messages without syncing after every message. 587!ipfw 588*.* -/var/log/ipfw 589 590# Log ipfw messages with "Deny" in the message body. 591:msg, contains, ".*Deny.*" 592*.* /var/log/ipfw.deny 593 594# Reset program name filtering 595!* 596 597# Log messages from bird or bird6 into one file 598:programname, regex, "^bird6?$" 599*.* /var/log/bird-all.log 600 601# Log messages from servers in racks 10-19 in multiple locations, case insensitive 602:hostname, icase_ereregex, "^server-(dcA|podB|cdn)-rack1[0-9]{2}\\..*" 603*.* /var/log/racks10..19.log 604.Ed 605.Sh SEE ALSO 606.Xr syslog 3 , 607.Xr syslogd 8 608.Sh BUGS 609The effects of multiple 610.Em selectors 611are sometimes not intuitive. 612For example 613.Dq mail.crit,*.err 614will select 615.Dq mail 616facility messages at the level of 617.Dq err 618or higher, not at the level of 619.Dq crit 620or higher. 621.Pp 622In networked environments, note that not all operating systems 623implement the same set of facilities. 624The facilities 625authpriv, cron, ftp, and ntp that are known to this implementation 626might be absent on the target system. 627Even worse, DEC UNIX uses 628facility number 10 (which is authpriv in this implementation) to 629log events for their AdvFS file system. 630