SYSLOGD(8) BSD System Manager's Manual SYSLOGD(8)
syslogd -- log systems messages
syslogd [-dnrs] [-f config_file] [-g group] [-m mark_interval]
[-P file_list] [-p log_socket [-p log_socket2 ...]]
[-t chroot_dir] [-u user]
syslogd reads and logs messages to the system console, log files, other
machines and/or users as specified by its configuration file. The
options are as follows:
-d Enable debugging to the standard output, and do not dis-
associate from the controlling terminal.
-f Specify the pathname of an alternative configuration
file; the default is /etc/syslog.conf.
-g group Set GID to group after the sockets and log files have
-m Select the number of minutes between ``mark'' messages;
the default is 20 minutes.
-n Do not perform hostname lookups; report only numeric
-P Specify the pathname of a file containing a list of
sockets to be created. The format of the file is simply
one socket per line.
-p Specify the pathname of a log socket. Multiple -p
options create multiple log sockets. If no -p arguments
are created, the default socket of /var/run/log is used.
-r Disable the compression of repeated instances of the
same line into a single line of the form ``last message
repeated N times''.
-s Select ``secure'' mode, in which syslogd does not listen
on a UDP socket but only communicates over a UNIX domain
socket. This is valuable when the machine on which
syslogd runs is subject to attack over the network and
it is desired that the machine be protected from
attempts to remotely fill logs and similar attacks.
-t chroot_dir chroot(2) to chroot_dir after the sockets and log files
have been opened.
-u user Set UID to user after the sockets and log files have
syslogd reads its configuration file when it starts up and whenever it
receives a hangup signal. For information on the format of the configu-
ration file, see syslog.conf(5).
syslogd reads messages from the UNIX domain socket /var/run/log, from an
Internet domain socket specified in /etc/services, and from the special
device /dev/klog (to read kernel messages).
syslogd creates the file /var/run/syslogd.pid, and stores its process id
there. This can be used to kill or reconfigure syslogd.
By using multiple -p options, one can set up many chroot environments by
passing the pathname to the log socket (/var/run/log) in each chroot area
to syslogd. For example:
syslogd -p /var/run/log -p /web/var/run/log -p /ftp/var/run/log
Note: the normal log socket must now also be passed to syslogd.
The logged message includes the date, time, and hostname (or pathname of
the log socket). Commonly, the program name and the process id is
Accesses from UDP socket can be filtered by libwrap configuration files,
like /etc/hosts.deny. Specify ``syslogd'' in daemon_list portion of the
configuration files. Refer to hosts_access(5) for details.
SYSLOG PROTOCOL NOTES
The message sent to syslogd should consist of a single line. The message
can contain a priority code, which should be a preceding decimal number
in angle braces, for example, '<5>'. This priority code should map into
the priorities defined in the include file <sys/syslog.h>.
/etc/syslog.conf The configuration file.
/var/run/syslogd.pid The process id of current syslogd.
/var/run/log Name of the UNIX domain datagram log socket.
/dev/klog The kernel log device.
logger(1), syslog(3), services(5), syslog.conf(5), newsyslog(8)
The syslogd command appeared in 4.3BSD. Support for multiple log sockets
appeared in NetBSD 1.4. libwrap support appeared in NetBSD 1.6.
BSD October 17, 2003 BSD