`/etc/syslog.conf`

Configuration file for syslogd

Name:

/etc/syslog.conf

Description:

The /etc/syslog.conf file is the configuration file for the syslogd daemon. It consists of lines with two fields:

Selector field: The types of messages and priorities to which the line applies.
Action field: The action to take if a message received by syslogd matches the selection criteria.

Use one or more tab characters to separate the selector and action fields.

The selectors are encoded as a facility, a dot (.), and a level, with no intervening whitespace. Both the facility and the level are case-insensitive.

The facility describes the part of the system generating the message, and is one of the following keywords:

auth
authpriv
cron
daemon
kern
lpr
mail
mark
news
syslog
user
uucp
local0 through local7.

These keywords (with the exception of mark) correspond to the similar "LOG_" values specified to the openlog() and syslog() routines.

The level describes the severity of the message, and is a keyword from the following ordered (higher to lower) list:

emerg
alert
crit
err
warning
notice
info
debug

These keywords also correspond to the similar "LOG_" values specified to the syslog() routine.

For further descriptions of both the facility and level keywords and their significance, see syslog() in the Library Reference.

If a received message matches the specified facility and is of the specified (or higher) level, then the action specified in the action field is taken.

You can specify multiple selectors for a single action by separating them with semicolon (;) characters.

Note that each selector can modify the ones preceding it.

You can specify multiple facilities for a single level by separating them with comma (,) characters.

You can use an asterisk (*) to specify all facilities or all levels.

The special facility mark receives a message at priority info every 20 minutes (see syslogd).

The special level none disables a particular facility.

The action field of each line specifies the action to be taken when the selector field selects a message. The action field can take these forms:

a pathname (beginning with a leading slash) -- the selected messages are appended to the file
a hostname (preceded by @) -- the selected messages are forwarded to the syslogd program on the named host

Blank lines and lines whose first nonblank character is a hash (#) character are ignored.

Examples:

A configuration file might appear as follows:

# Log all kernel messages, authentication messages of
# level notice or higher and anything of level err or
# higher to the console.
# Don't log private authentication messages!
*.err;kern.*;auth.notice;authpriv.none /dev/console

# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none         /var/log/messages

# The authpriv file has restricted access.
authpriv.*                             /var/log/secure

# Log all the mail messages in one place.
mail.*                                 /var/log/maillog

# Everybody gets emergency messages, plus log them on
# another machine.
*.emerg                    *
*.emerg                    @arpa.berkeley.edu

# Root and Eric get alert and higher messages.
*.alert                    root,eric

# Save mail and news errors of level err and higher in a
# special file.
uucp,news.crit             /var/log/spoolerr

Caveats:

The effects of multiple selectors aren't always intuitive. For example, mail.crit,*.err selects mail facility messages at the level of err or higher, not at the level of crit or higher.

Logging messages to users isn't currently implemented.

/etc/syslog.conf