The FreeBSD Diary |
(TM) | I remember |
syslog.conf - putting stuff where you want it
2 April 1999
|
The default /etc/syslog.conf displays many messages directly on the console. That may not be what you want. Here's how to change that. |
syslogd
|
syslog is the function used by many programs to write a message to the system message logger (syslogd). The syslogd daemon reads and logs messages to the system console, log files, other machines and/or users as specified by its configuration file (/etc/syslog.conf). |
syslog.conf
|
The first thing you need to know about syslog.conf is that it needs tabs, not spaces.
So if you modify your file and suddenly start getting errors
like this, then you probably added spaces not tabs. Note that ee add
spaces even if you press tab whereas vi does not. If in doubt, check it
out. Here is the default syslog.conf as it comes with FreeBSD 3.1: # $Id: syslogconf.php,v 1.22 2007/08/27 16:34:48 dan Exp $ # # Spaces are NOT valid field separators in this file. # Consult the syslog.conf(5) manpage. *.err;kern.debug;auth.notice;mail.crit /dev/console *.notice;kern.debug;lpr.info;mail.crit;news.err /var/log/messages mail.info /var/log/maillog lpr.info /var/log/lpd-errs cron.* /var/cron/log *.err root *.notice;news.err root *.alert root *.emerg * # uncomment these if you're running inn # news.crit /var/log/news/news.crit # news.err /var/log/news/news.err # news.notice /var/log/news/news.notice !startslip *.* /var/log/slip.log !ppp *.* /var/log/ppp.log Here is the syslog.conf file I created for a friend (the first line is split for readablity): *.*;mail.none;cron.none;kern.none;local0.none;ftp.none;auth.none; authpriv.none /var/log/messages mail.* /var/log/maillog cron.* /var/cron/log kern.* /var/log/kernel.log auth.*;authpriv.* /var/log/auth.log # uncomment these if you're running inn # news.crit /var/log/news/news.crit # news.err /var/log/news/news.err # news.notice /var/log/news/news.notice local0.* /var/log/tcpd.log local0.info;local0.debug /var/log/firewall.log local0.err /var/log/firewall.err ftp.* /var/log/ftp.log !startslip *.* /var/log/slip.log !ppp *.* /var/log/ppp.log !popper *.* /var/log/popper.log NOTE: the above examples contain spaces. Remember to change them to tabs if you do a copy/paste from here. |
man syslog.conf
|
What you really need to read up on is man syslog.conf. |
What's changed
|
The first thing you should notice is that I've removed /dev/console from the file. The site did not want any messages appearing on the console. Some people are like that. You'll also see that various other messages are diverted to other places. That's what they wanted. You will have to decide if that's for you or not. |
After making changes
|
After you make changes to /etc/syslog.conf, remember to tell syslogd
about them! The following command will make syslogd read its configuration
file.killall -HUP syslogd |