.\" Copyright (c) 1990, 1991, 1993
.\" The Regents of the University of California. All rights reserved.
.\" %sccs.include.redist.roff%
.\" @(#)syslog.conf.5 8.1 (Berkeley) %G%
file is the configuration file for the
It consists of lines with two fields: the
field which specifies the types of messages and priorities to which the
field which specifies the action to be taken if a message
receives matches the selection criteria.
field is separated from the
field by one or more tab characters.
with no intervening white-space.
describes the part of the system generating the message, and is one of
the following keywords: auth, authpriv, cron, daemon, kern, lpr, mail,
mark, news, syslog, user, uucp and local0 through local7.
These keywords (with the exception of mark) correspond to the
describes the severity of the message, and is a keyword from the
following ordered list (higher to lower): emerg, alert, crit, err,
warning, notice and debug.
These keywords correspond to the
for a further descriptions of both the
keywords and their significance.
If a received message matches the specified
.Em (or a higher level) ,
the action specified in the
may be specified for a single
by separating them with semicolon (``;'') characters.
It is important to note, however, that each
can modify the ones preceding it.
may be specified for a single
by separating them with comma (``,'') characters.
An asterisk (``*'') can be used to specify all
``mark'' receives a message at priority ``info'' every 20 minutes
field containing an asterisk.
``none'' disables a particular
field of each line specifies the action to be taken when the
A pathname (beginning with a leading slash).
Selected messages are appended to the file.
A hostname (preceded by an at (``@'') sign).
Selected messages are forwarded to the
program on the named host.
A comma separated list of users.
Selected messages are written to those users
Selected messages are written to all logged-in users.
Blank lines and lines whose first non-blank character is a hash (``#'')
A configuration file might appear as follows:
# Log all kernel messages, authentication messages of
# level notice or higher and anything of level err or
# Don't log private authentication messages!
*.err;kern.*;auth.notice;authpriv.none /dev/console
# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none /var/log/messages
# The authpriv file has restricted access.
authpriv.* /var/log/secure
# Log all the mail messages in one place.
# Everybody gets emergency messages, plus log them on another
*.emerg @arpa.berkeley.edu
# Root and Eric get alert and higher messages.
# Save mail and news errors of level err and higher in a
uucp,news.crit /var/log/spoolerr
.Bl -tag -width /etc/syslog.conf -compact
The effects of multiple selectors are sometimes not intuitive.
For example ``mail.crit,*.err'' will select ``mail'' facility messages at
the level of ``err'' or higher, not at the level of ``crit'' or higher.