SYSLOG.CONF(4)SYSLOG.CONF(4)NAMEsyslog.conf - configuration file for syslogd system log daemon
The file /etc/syslog.conf contains information used by the system log
daemon, syslogd(1M), to forward a system message to appropriate log
files and/or users. syslogd preprocesses this file through m4(1) to
obtain the correct information for certain log files, defining LOGHOST
if the address of "loghost" is the same as one of the addresses of the
host that is running syslogd.
A configuration entry is composed of two TAB-separated fields:
The selector field contains a semicolon-separated list of priority
specifications of the form:
facility.level [ ; facility.level ]
where facility is a system facility, or comma-separated list of facili‐
ties, and level is an indication of the severity of the condition being
logged. The presence of a facility name only implies that it is avail‐
able. Each individual service determines which facility it will use
for logging. In particular, many facilities are only useful for syslog
messages that are forwarded from other operating systems. Recognized
values for facility include:
Messages generated by the kernel.
Messages generated by user processes. This is the default
priority for messages from programs or facilities not
listed in this file.
The mail system.
Various system daemons.
The authorization system: login(1), su(1M), getty(1M),
The line printer spooling system: lpr(1B), lpc(1B), among
Designated for the USENET network news system.
Designated for the UUCP system; it does not currently use
the syslog mechanism.
Designated for the BSD cron/at system.
Designated for the BSD security/authorization system.
Designated for the file transfer system. The current ver‐
sion of in.ftpd(1M) does not use this facility for logging.
Designated for the network time system.
Designated for audit messages generated by systems that
audit by means of syslog.
Designated for the BSD console system.
Designated for cron/at messages generated by systems that
do logging through syslog. The current versions of cron
and at do not use this facility for logging.
Designated for local use.
For timestamp messages produced internally by syslogd.
An asterisk indicates all facilities except for the mark
Recognized values for level are (in descending order of severity):
For panic conditions that would normally be broadcast to all
For conditions that should be corrected immediately, such as
a corrupted system database.
For warnings about critical conditions, such as hard device
For other errors.
For warning messages.
For conditions that are not error conditions, but may
require special handling. A configuration entry with a
level value of notice must appear on a separate line.
For messages that are normally used only when debugging a
Do not send messages from the indicated facility to the
selected file. For example, a selector of
sends all messages except mail messages to the selected
For a given facility and level, syslogd matches all messages for that
level and all higher levels. For example, an entry that specifies a
level of crit also logs messages at the alert and emerg levels.
The action field indicates where to forward the message. Values for
this field can have one of four forms:
o A filename, beginning with a leading slash, which indicates
that messages specified by the selector are to be written to
the specified file. The file is opened in append mode if it
exists. If the file does not exist, logging silently fails
for this action.
o The name of a remote host, prefixed with an @, as with:
@server, which indicates that messages specified by the
selector are to be forwarded to the syslogd on the named
host. The hostname "loghost" is treated, in the default sys‐
log.conf, as the hostname given to the machine that logs
syslogd messages. Every machine is "loghost" by default, per
the hosts database. It is also possible to specify one
machine on a network to be "loghost" by, literally, naming
the machine "loghost". If the local machine is designated to
be "loghost", then syslogd messages are written to the
appropriate files. Otherwise, they are sent to the machine
"loghost" on the network.
o A comma-separated list of usernames, which indicates that
messages specified by the selector are to be written to the
named users if they are logged in.
o An asterisk, which indicates that messages specified by the
selector are to be written to all logged-in users.
Blank lines are ignored. Lines for which the first nonwhite character
is a '#' are treated as comments.
Example 1 A Sample Configuration File
With the following configuration file:
syslogd(1M) logs all mail system messages except debug messages and all
notice (or higher) messages into a file named /var/log/notice. It logs
all critical messages into /var/log/critical, and all kernel messages
and 20-minute marks onto the system console.
Kernel messages of err (error) severity or higher are forwarded to the
machine named server. Emergency messages are forwarded to all users.
The users root and operator are informed of any alert messages. All
messages from the authorization system of warning level or higher are
logged in the file /var/log/auth.
See attributes(5) for descriptions of the following attributes:
│ ATTRIBUTE TYPE │ ATTRIBUTE VALUE │
│Interface Stability │ Stable │
SEE ALSOat(1), crontab(1), logger(1), login(1), lp(1), lpc(1B), lpr(1B), m4(1),
cron(1M), getty(1M), in.ftpd(1M), su(1M), syslogd(1M), syslog(3C),
Nov 19, 2013 SYSLOG.CONF(4)