The FreeBSD Diary

Providing practical examples since 1998

If you buy from Amazon USA, please support us by using this link.

syslog.conf - putting stuff where you want it 2 April 1999

Need more help on this topic? Click here
This article has no comments
Show me similar articles

The default /etc/syslog.conf displays many messages directly on the console. That may not be what you want. Here's how to change that.

syslogd

syslog is the function used by many programs to write a message to the system message logger (syslogd). The syslogd daemon reads and logs messages to the system console, log files, other machines and/or users as specified by its configuration file (/etc/syslog.conf).

syslog.conf

The first thing you need to know about syslog.conf is that it needs tabs, not spaces. So if you modify your file and suddenly start getting errors like this, then you probably added spaces not tabs. Note that ee add spaces even if you press tab whereas vi does not. If in doubt, check it out.

Here is the default syslog.conf as it comes with FreeBSD 3.1:

#       $Id: syslogconf.php,v 1.22 2007/08/27 16:34:48 dan Exp $
#
#       Spaces are NOT valid field separators in this file.
#       Consult the syslog.conf(5) manpage.
*.err;kern.debug;auth.notice;mail.crit          /dev/console
*.notice;kern.debug;lpr.info;mail.crit;news.err /var/log/messages
mail.info                                       /var/log/maillog
lpr.info                                        /var/log/lpd-errs
cron.*                                          /var/cron/log
*.err                                           root
*.notice;news.err                               root
*.alert                                         root
*.emerg                                         *
# uncomment these if you're running inn
# news.crit                                  /var/log/news/news.crit
# news.err                                   /var/log/news/news.err
# news.notice                                /var/log/news/news.notice
!startslip
*.*                                          /var/log/slip.log
!ppp
*.*                                          /var/log/ppp.log

Here is the syslog.conf file I created for a friend (the first line is split for readablity):

*.*;mail.none;cron.none;kern.none;local0.none;ftp.none;auth.none;
                                      authpriv.none  /var/log/messages
mail.*                                       /var/log/maillog
cron.*                                       /var/cron/log
kern.*                                       /var/log/kernel.log
auth.*;authpriv.*                            /var/log/auth.log

# uncomment these if you're running inn
# news.crit                                  /var/log/news/news.crit
# news.err                                   /var/log/news/news.err
# news.notice                                /var/log/news/news.notice

local0.*                                     /var/log/tcpd.log
local0.info;local0.debug                     /var/log/firewall.log
local0.err                                   /var/log/firewall.err

ftp.*                                        /var/log/ftp.log

!startslip
*.*                                          /var/log/slip.log

!ppp
*.*                                          /var/log/ppp.log

!popper
*.*                                          /var/log/popper.log

NOTE: the above examples contain spaces. Remember to change them to tabs if you do a copy/paste from here.

man syslog.conf

What you really need to read up on is man syslog.conf.

What's changed

The first thing you should notice is that I've removed /dev/console from the file. The site did not want any messages appearing on the console. Some people are like that. You'll also see that various other messages are diverted to other places. That's what they wanted. You will have to decide if that's for you or not.

After making changes

After you make changes to /etc/syslog.conf, remember to tell syslogd about them! The following command will make syslogd read its configuration file.

killall -HUP syslogd

Need more help on this topic? Click here
This article has no comments
Show me similar articles