4.3BSD - /usr/man/cat8/syslogd.0

SYSLOGD(8)                                                          SYSLOGD(8)


NAME
       syslogd - log systems messages

SYNOPSIS
       /etc/syslogd [ -fconfigfile ] [ -mmarkinterval ] [ -d ]

DESCRIPTION
       Syslogd  reads  and  logs messages into a set of files described by the
       configuration file /etc/syslog.conf.  Each message is one line.  A mes‐
       sage can contain a priority code, marked by a number in angle braces at
       the beginning of the line.  Priorities are defined  in  <sys/syslog.h>.
       Syslogd  reads  from  the UNIX domain socket /dev/log, from an Internet
       domain socket specified in /etc/services, and from the  special  device
       /dev/klog (to read kernel messages).

       Syslogd  configures when it starts up and whenever it receives a hangup
       signal.  Lines in the configuration file have a selector  to  determine
       the  message  priorities  to which the line applies and an action.  The
       action field are separated from the selector by one or more tabs.

       Selectors are semicolon separated lists of priority  specifiers.   Each
       priority  has  a facility describing the part of the system that gener‐
       ated the message, a dot, and a level indicating  the  severity  of  the
       message.   Symbolic names may be used.  An asterisk selects all facili‐
       ties.  All messages of the specified level or higher (greater severity)
       are  selected.   More than one facility may be selected using commas to
       separate them.  For example:

            *.emerg;mail,daemon.crit

       Selects all facilities at the emerg  level  and  the  mail  and  daemon
       facilities at the crit level.

       Known  facilities  and levels recognized by syslogd are those listed in
       syslog(3)  without  the  leading  ‘‘LOG_’’.   The  additional  facility
       ‘‘mark’’ has a message at priority LOG_INFO sent to it every 20 minutes
       (this may be changed with the -m flag).  The ‘‘mark’’ facility  is  not
       enabled by a facility field containing an asterisk.  The level ‘‘none’’
       may be used to disable a particular facility.  For example,

            *.debug;mail.none

       Sends all messages except mail messages to the selected file.

       The second part of each line describes  where  the  message  is  to  be
       logged if this line is selected.  There are four forms:

       ·  A  filename  (beginning  with  a  leading  slash).  The file will be
          opened in append mode.

       ·  A hostname preceeded by an at sign (‘‘@’’).  Selected  messages  are
          forwarded to the syslogd on the named host.

       ·  A  comma  separated list of users.  Selected messages are written to
          those users if they are logged in.

       ·  An asterisk.  Selected messages are written to all logged-in  users.

       Blank lines and lines beginning with ‘#’ are ignored.

       For example, the configuration file:

           kern,mark.debug        /dev/console
           *.notice;mail.info     /usr/spool/adm/syslog
           *.crit                 /usr/adm/critical
           kern.err               @ucbarpa
           *.emerg                *
           *.alert                eric,kridle
           *.alert;auth.warning   ralph

       logs  all  kernel messages and 20 minute marks onto the system console,
       all notice (or higher) level messages  and  all  mail  system  messages
       except  debug  messages  into  the  file /usr/spool/adm/syslog, and all
       critical messages into  /usr/adm/critical;  kernel  messages  of  error
       severity  or  higher  are  forwarded  to  ucbarpa.   All  users will be
       informed of any emergency messages, the users ‘‘eric’’  and  ‘‘kridle’’
       will  be informed of any alert messages, and the user ‘‘ralph’’ will be
       informed of any alert message, or any warning message (or higher)  from
       the authorization system.

       The flags are:

       -f   Specify an alternate configuration file.

       -m   Select the number of minutes between mark messages.

       -d   Turn on debugging.

       Syslogd  creates  the  file  /etc/syslog.pid, if possible, containing a
       single line with its process id.  This can be used to kill or reconfig‐
       ure syslogd.

       To  bring syslogd down, it should be sent a terminate signal (e.g. kill
       `cat /etc/syslog.pid`).

FILES
       /etc/syslog.conf    the configuration file
       /etc/syslog.pid     the process id
       /dev/log            Name of the UNIX domain datagram log socket
       /dev/klog           The kernel log device

SEE ALSO
       logger(1), syslog(3)


4.2 Berkeley Distribution        May 26, 1986                       SYSLOGD(8)