*** UNIX MANUAL PAGE BROWSER ***

syslogd(8) System Manager's Manual syslogd(8) NAME syslogd - Logs system messages SYNOPSIS /usr/sbin/syslogd [-b buffer_size] [-f config_file] [-m mark_in- terval] [-d] The syslogd daemon reads and logs messages to a set of files described in the /etc/syslog.conf configuration file. DESCRIPTION Each message logged consists of one line. A message can contain a pri- ority code, marked by a number in angle braces at the beginning of the line. Priorities are defined in the /usr/include/sys/syslog.h file. The syslogd daemon reads from the domain socket /dev/log, from an In- ternet domain socket specified in /etc/services, and from the special device /dev/klog, which reads kernel messages. The syslogd daemon con- figures when it starts up and when it receives a hangup signal. The /etc/syslog.conf file contains entries that specify the facility (the part of the system that generated the error), the error message severity level, and the destination to which the syslogd daemon sends the messages. Each line of the /etc/syslog.conf file contains an en- try. The following is an example of an /etc/syslog.conf file: # # syslogd config file # # facilities: kern user mail daemon auth syslog lpr bi- nary # priorities: emerg alert crit err warning notice info debug kern.debug /var/adm/syslog/kern.log user.debug /var/adm/syslog/user.log daemon.debug /var/adm/syslog/dae- mon.log auth.debug /var/adm/syslog/auth.log syslog.debug /var/adm/syslog/syslog.log mail,lpr.debug /var/adm/sys- log/misc.log binary.err /var/adm/binary.errlog msgbuf.err /var/adm/crash/msgbuf.savecore kern.debug /var/adm/mes- sages kern.debug /dev/console *.emerg * The facility and its severity level must be separated by a period (.). You can specify more than one facility on a line by separating them with commas. You can specify more than one facility and severity level on a line by separating them with semicolons. The facility and its severity level must be separated from the destina- tion by one or more tabs (spaces are not allowed). If you specify an asterisk (*) for a facility, messages generated by all parts of the system are logged. All messages of the specified level and of a greater severity are logged. Blank lines and lines be- ginning with # (number sign) are ignored. For example: *.emerg;mail,daemon.crit /var/adm/syslog/misc.log This line logs all facilities at the emerg level (and higher) and the mail and daemon facilities at the crit (or higher) level to the /var/adm/syslog/misc.log destination file. Known facilities and levels recognized by the syslogd daemon are those listed in syslog without the leading LOG_. The additional facility mark has a message at priority LOG_INFO sent to it every 20 minutes (this may be changed with the -m flag). The mark facility is not en- abled by a facility field containing an * (asterisk). The level none may be used to disable a particular facility. For example: *.de- bug;mail.none /var/adm/syslog/misc.log The previous entry sends all messages except mail messages to the /var/adm/syslog/misc.log file. There are four possibilities for the message destination: A filename that begins with a leading / (slash). The syslogd daemon will open the file in append mode. A hostname preceded by an @ (at sign). Selected messages are forwarded to the syslogd daemon on the named host. A comma separated list of users. Selected messages are written to those users if they are logged in. An * (asterisk). Selected messages are written to all users who are logged in. For example: kern,mark.debug /dev/console *.no- tice;mail.info /var/adm/syslog/mail *.crit /var/adm/syslog/critical kern.err @ucbarpa *.emerg * *.alert eric,kridle *.alert;auth.warn- ing ralph The preceding configuration file logs messages as fol- lows: Logs all kernel messages and 20 minute marks onto the system con- sole Logs all notice (or higher) level messages and all mail system messages except debug messages into the file /var/adm/syslog/mail Logs all critical messages into the /var/adm/syslog/critical file Forwards kernel messages of error severity or higher to ucbarpa. Informs all users of any emergency messages, informs users eric and kridle of any alert messages, and informs user ralph of any alert message or any warning message (or higher) from the authorization system. Destinations for logged messages can be specified with full pathnames that begin with a leading / (slash). The syslogd daemon then opens the specified file(s) in append mode. If the pathname to a syslogd daemon log file that is specified in the syslog.conf file as a /var/adm/sys- log.dated/file, the syslogd daemon inserts a date directory, and thus produces a day-by-day account of the messages received, directly above file in the directory structure. Typically, you will want to divert messages separately, according to facility, into files such as kern.log, mail.log, lpr.log, and debug.log. If some pathname other than /var/adm/syslog.dated/file is specified as the pathname to the logfile, the syslogd daemon does not create the daily date directory. For example, if you specify /var/adm/sys- log/mail.log (without the .dated suffix after syslog), the syslogd dae- mon simply logs messages to the mail.log file and allows this file to grow indefinitely. The syslogd daemon can recover the messages in the kernel syslog buffer that were not logged to the files specified in the /etc/syslog.conf file because a system crash occurred. The savecore command copies the buffer recovered from the dump to the file specified in the "msg- buf.err" entry in the /etc/syslog.conf file. When the syslogd daemon starts up, it looks for this file and, if it exists, processes and then deletes the file. Examining the Error Log Files The syslogd daemon acts as a central routing facility for messages whose formats are determined by the programs that produce them. The syslogd daemon creates the /var/run/syslog.pid file if possible. The file contains a single line with its process ID. This can be used to kill or reconfigure the syslogd daemon. To bring the syslogd daemon down, send it a terminate signal (for exam- ple: kill `cat /var/run/syslog.pid`). If a syslog.conf configuration file does not exist, the syslogd daemon uses the following defaults: *.ERR /dev/console *.PANIC * The defaults log all error messages to the console and all panic messages (from the kernel) to all logged-in users. No files are written. Remote message Forwarding The syslog has a remote message forwarding function. As a security fea- ture, this capability is turned off by default. If you intend to con- figure other hosts to forward syslog messages to a local host, use the su command to become superuser (root) and manually create the /etc/sys- log.auth file using a text editor on the local host. The /etc/syslog.auth file specifies which remote hosts are allowed to forward syslog messages to the local host. Unless the domain host name of a remote host is given in the local /etc/syslog.auth file, the local host will not log any syslog messages from that remote host. Please see the syslog.auth(4) reference page for information. FLAGS The default size of the socket receive buffer is 128 Kbytes. With the -b flag, you can reduce this buffer size to a minimum of 4 Kbytes. Turns on debugging. Specifies an alternate configuration file. Se- lects the number of minutes between mark messages. FILES Specifies the command path Configuration file. Process ID. The name of the domain datagram log socket. Kernel log device. RELATED INFORMATION Commands: savecore(8) Functions: syslog(3) Network Administration delim off syslogd(8)