Update man pages with new per-rule options and fix old paths
Signed-off-by: Joachim Nilsson <troglobit@gmail.com>
This commit is contained in:
parent
84aa897628
commit
cebec1202b
2
TODO.org
2
TODO.org
@ -9,7 +9,7 @@
|
|||||||
** DONE Test support of =/etc/syslog.d/*.conf= to syslogd
|
** DONE Test support of =/etc/syslog.d/*.conf= to syslogd
|
||||||
** Test SIGHUP of syslogd
|
** Test SIGHUP of syslogd
|
||||||
** DONE Custom facilities!
|
** DONE Custom facilities!
|
||||||
** Fix option parsing in syslog.conf, e.g. ;RFC5424 and log rotation
|
** DONE Fix option parsing in syslog.conf, e.g. ;RFC5424 and log rotation
|
||||||
** Test with/without openlog()
|
** Test with/without openlog()
|
||||||
** Test custom facilities
|
** Test custom facilities
|
||||||
** Test setlogmask()
|
** Test setlogmask()
|
||||||
|
@ -305,12 +305,12 @@ five files in total are kept, including the non-rotated file.
|
|||||||
This stores all messages of priority
|
This stores all messages of priority
|
||||||
.Ql crit
|
.Ql crit
|
||||||
in the file
|
in the file
|
||||||
.Pa /var/adm/critical ,
|
.Pa /var/log/critical ,
|
||||||
with the exception of any kernel messages.
|
with the exception of any kernel messages.
|
||||||
.Bd -literal -offset indent
|
.Bd -literal -offset indent
|
||||||
# Store critical stuff in critical
|
# Store critical stuff in critical
|
||||||
#
|
#
|
||||||
*.=crit;kern.none /var/adm/critical
|
*.=crit;kern.none /var/log/critical
|
||||||
.Ed
|
.Ed
|
||||||
.Ss Kernel
|
.Ss Kernel
|
||||||
This is an example of the 2nd selector overwriting part of the first
|
This is an example of the 2nd selector overwriting part of the first
|
||||||
@ -325,19 +325,18 @@ and
|
|||||||
.Ql warning
|
.Ql warning
|
||||||
to get logged.
|
to get logged.
|
||||||
.Bd -literal -offset indent
|
.Bd -literal -offset indent
|
||||||
# Kernel messages are stored in the kernel file,
|
# Kernel messages are stored in the kernel file, critical messages and
|
||||||
# critical messages and higher ones also go
|
# higher ones also go to another host and to the console
|
||||||
# to another host and to the console
|
|
||||||
#
|
#
|
||||||
kern.* /var/adm/kernel
|
kern.* /var/log/kernel
|
||||||
kern.crit @finlandia;RFC5424
|
kern.crit @finlandia ;RFC5424
|
||||||
kern.crit /dev/console
|
kern.crit /dev/console
|
||||||
kern.info;kern.!err /var/adm/kernel-info
|
kern.info;kern.!err /var/log/kernel.info
|
||||||
.Ed
|
.Ed
|
||||||
.Pp
|
.Pp
|
||||||
The first rule directs any message that has the kernel facility to the
|
The first rule directs any message that has the kernel facility to the
|
||||||
file
|
file
|
||||||
.Pa /var/adm/kernel .
|
.Pa /var/log/kernel .
|
||||||
Recall that only the kernel itself can log to this facility.
|
Recall that only the kernel itself can log to this facility.
|
||||||
.Pp
|
.Pp
|
||||||
The second statement directs all kernel messages of priority
|
The second statement directs all kernel messages of priority
|
||||||
@ -361,7 +360,7 @@ to save all kernel messages that come with priorities from
|
|||||||
up to
|
up to
|
||||||
.Ql warning
|
.Ql warning
|
||||||
in the file
|
in the file
|
||||||
.Pa /var/adm/kernel-info .
|
.Pa /var/log/kernel.info .
|
||||||
.Ss Redirecting to a TTY
|
.Ss Redirecting to a TTY
|
||||||
This directs all messages that use
|
This directs all messages that use
|
||||||
.Ql mail.info
|
.Ql mail.info
|
||||||
@ -384,11 +383,11 @@ This pattern matches all messages that come with the
|
|||||||
facility, except for the
|
facility, except for the
|
||||||
.Ql info
|
.Ql info
|
||||||
priority. These will be stored in the file
|
priority. These will be stored in the file
|
||||||
.Pa /var/adm/mail .
|
.Pa /var/log/mail .
|
||||||
.Bd -literal -offset indent
|
.Bd -literal -offset indent
|
||||||
# Write all mail related logs to a file
|
# Write all mail related logs to a file
|
||||||
#
|
#
|
||||||
mail.*;mail.!=info /var/adm/mail
|
mail.*;mail.!=info /var/log/mail
|
||||||
.Ed
|
.Ed
|
||||||
.Ss Single Priority from Two Facilities
|
.Ss Single Priority from Two Facilities
|
||||||
This will extract all messages that come either with
|
This will extract all messages that come either with
|
||||||
@ -396,11 +395,11 @@ This will extract all messages that come either with
|
|||||||
or with
|
or with
|
||||||
.Ql news.info
|
.Ql news.info
|
||||||
and store them in the file
|
and store them in the file
|
||||||
.Pa /var/adm/info .
|
.Pa /var/log/info .
|
||||||
.Bd -literal -offset indent
|
.Bd -literal -offset indent
|
||||||
# Log all mail.info and news.info messages to info
|
# Log all mail.info and news.info messages to info
|
||||||
#
|
#
|
||||||
mail,news.=info /var/adm/info
|
mail,news.=info /var/log/info
|
||||||
.Ed
|
.Ed
|
||||||
.Ss Advanced Filtering, part 1
|
.Ss Advanced Filtering, part 1
|
||||||
This logs all messages that come with either the
|
This logs all messages that come with either the
|
||||||
@ -456,8 +455,8 @@ and 'joey', if they're logged in.
|
|||||||
*.alert root,joey
|
*.alert root,joey
|
||||||
.Ed
|
.Ed
|
||||||
.Ss Log Rotation
|
.Ss Log Rotation
|
||||||
This logs all messages except kernel messages to the file
|
This example logs all messages except kernel messages to the file
|
||||||
.Pa /log/messages
|
.Pa /var/log/messages
|
||||||
without syncing ('-') the file after each log message. When the file
|
without syncing ('-') the file after each log message. When the file
|
||||||
reaches 100 kiB it is rotated. In total are only 10 rotated files,
|
reaches 100 kiB it is rotated. In total are only 10 rotated files,
|
||||||
including the main file itself and compressed files kept. The size
|
including the main file itself and compressed files kept. The size
|
||||||
|
@ -193,22 +193,28 @@ version and exit.
|
|||||||
.Sh CONFIGURATION FILE SYNTAX DIFFERENCES
|
.Sh CONFIGURATION FILE SYNTAX DIFFERENCES
|
||||||
.Nm
|
.Nm
|
||||||
uses a slightly different syntax for its configuration file than the
|
uses a slightly different syntax for its configuration file than the
|
||||||
original BSD sources. Originally all messages of a specific priority
|
original BSD sources. First, rules may now also have a third field
|
||||||
and above were forwarded to the log file.
|
.Cm ;OPTION .
|
||||||
|
Several options are supported, comma separated, that control formatting
|
||||||
|
and log rotation, for more on this see
|
||||||
|
.Xr syslog.conf 5 .
|
||||||
|
Second, originally all messages of a specific priority and above were
|
||||||
|
forwarded to the log file.
|
||||||
.Pp
|
.Pp
|
||||||
For example the following line caused ALL output from daemons using
|
For example the following line send all output from daemons using the
|
||||||
the daemon facilities (debug is the lowest priority, so every higher
|
daemon facilities (debug is the lowest priority, so every higher will
|
||||||
will also match) to go into
|
also match) to go into
|
||||||
.Pa /usr/adm/daemons :
|
.Pa /var/log/daemons :
|
||||||
.Bd -literal -offset indent
|
.Bd -literal -offset indent
|
||||||
# Sample syslog.conf
|
# Sample syslog.conf
|
||||||
daemon.debug /usr/adm/daemons
|
daemon.debug /var/log/daemons
|
||||||
.Ed
|
.Ed
|
||||||
.Pp
|
.Pp
|
||||||
Under the new scheme this behavior remains the same. The difference is
|
With
|
||||||
the addition of four new specifiers, the asterisk ('*') wildcard, the
|
.Nm
|
||||||
equation sign ('='), the exclamation mark ('!'), and the minus sign
|
this behavior remains the same. The difference is the addition of four
|
||||||
('-').
|
additional specifiers, the asterisk ('*') wildcard, the equation sign
|
||||||
|
('='), the exclamation mark ('!'), and the minus sign ('-').
|
||||||
.Pp
|
.Pp
|
||||||
The '*' specifies that all messages for the specified facility are to be
|
The '*' specifies that all messages for the specified facility are to be
|
||||||
directed to the destination. Note that this behavior is degenerate with
|
directed to the destination. Note that this behavior is degenerate with
|
||||||
@ -220,13 +226,14 @@ class. This allows, for example, routing only debug messages to a
|
|||||||
particular logging source.
|
particular logging source.
|
||||||
.Pp
|
.Pp
|
||||||
For example, the following line in
|
For example, the following line in
|
||||||
.Pa syslog.conf
|
.Pa /etc/syslog.conf
|
||||||
directs debug messages from all sources to the
|
directs debug messages from all sources to the
|
||||||
.Pa /usr/adm/debug
|
.Pa /var/log/debug
|
||||||
file.
|
file in RFC5424 format, with log rotation every 512 kiB, saving only 20
|
||||||
|
files in total (including the non-rotated file):
|
||||||
.Bd -literal -offset indent
|
.Bd -literal -offset indent
|
||||||
# Sample syslog.conf
|
# Sample syslog.conf
|
||||||
*.=debug /usr/adm/debug
|
*.=debug -/var/log/debug ;RFC5424,rotate=512k:20
|
||||||
.Ed
|
.Ed
|
||||||
.Pp
|
.Pp
|
||||||
.\" The '!' as the first character of a priority inverts the above
|
.\" The '!' as the first character of a priority inverts the above
|
||||||
@ -241,22 +248,24 @@ log all messages of facility
|
|||||||
except those with priority
|
except those with priority
|
||||||
.Ql info
|
.Ql info
|
||||||
to the
|
to the
|
||||||
.Pa /usr/adm/mail
|
.Pa /var/log/mail
|
||||||
file. All messages from
|
file. All messages from
|
||||||
.Ql news.info
|
.Ql news.info
|
||||||
(including) to
|
(including) to
|
||||||
.Ql news.crit
|
.Ql news.crit
|
||||||
(excluding) are logged to the
|
(excluding) are logged to the
|
||||||
.Pa /usr/adm/news
|
.Pa /var/log/news
|
||||||
file.
|
file.
|
||||||
.Bd -literal -offset indent
|
.Bd -literal -offset indent
|
||||||
# Sample syslog.conf
|
# Sample syslog.conf
|
||||||
mail.*;mail.!=info /usr/adm/mail
|
mail.*;mail.!=info /var/log/mail
|
||||||
news.info;news.!crit /usr/adm/news
|
news.info;news.!crit /var/log/news
|
||||||
.Ed
|
.Ed
|
||||||
.Pp
|
.Pp
|
||||||
You may use it intuitively as an exception specifier. The above
|
You may use it intuitively as an exception specifier. The above
|
||||||
mentioned interpretation is simply inverted. Doing that you may use
|
mentioned interpretation is simply inverted. For example, to skip
|
||||||
|
every message with facility
|
||||||
|
.Ar mail :
|
||||||
.Bd -literal -offset indent
|
.Bd -literal -offset indent
|
||||||
mail.none
|
mail.none
|
||||||
.Ed
|
.Ed
|
||||||
@ -269,19 +278,8 @@ or
|
|||||||
mail.!debug
|
mail.!debug
|
||||||
.Ed
|
.Ed
|
||||||
.Pp
|
.Pp
|
||||||
to skip every message that comes with a mail facility. There is much
|
|
||||||
room to play with it. :-)
|
|
||||||
.Pp
|
|
||||||
The '-' may only be used to prefix a filename if you want to omit
|
The '-' may only be used to prefix a filename if you want to omit
|
||||||
sync'ing the file after every write to it.
|
sync'ing the file after every write to it.
|
||||||
.Pp
|
|
||||||
This may take some acclimatization for those individuals used to the
|
|
||||||
pure BSD behavior but testers have indicated that this syntax is
|
|
||||||
somewhat more flexible than the BSD behavior. Note that these changes
|
|
||||||
do not affect standard
|
|
||||||
.Xr syslog.conf 5
|
|
||||||
files. You must specifically modify the configuration files to obtain
|
|
||||||
the new features.
|
|
||||||
.Sh REMOTE LOGGING
|
.Sh REMOTE LOGGING
|
||||||
The following modifications provide network support to the
|
The following modifications provide network support to the
|
||||||
.Nm
|
.Nm
|
||||||
@ -335,7 +333,7 @@ entry:
|
|||||||
.Bd -literal -offset indent
|
.Bd -literal -offset indent
|
||||||
# Sample syslogd configuration file to forward all message
|
# Sample syslogd configuration file to forward all message
|
||||||
# messages to a remote host using RFC5424 style formatting
|
# messages to a remote host using RFC5424 style formatting
|
||||||
*.* @hostname;RFC5424
|
*.* @hostname;RFC5424
|
||||||
.Ed
|
.Ed
|
||||||
.Pp
|
.Pp
|
||||||
To forward all
|
To forward all
|
||||||
@ -400,9 +398,9 @@ The following configuration file routes debug messages from the kernel
|
|||||||
to a FIFO:
|
to a FIFO:
|
||||||
.Bd -literal -offset indent
|
.Bd -literal -offset indent
|
||||||
# Sample configuration to route kernel debugging
|
# Sample configuration to route kernel debugging
|
||||||
# messages ONLY to /usr/adm/debug which is a
|
# messages ONLY to /var/log/debug which is a
|
||||||
# named pipe.
|
# named pipe.
|
||||||
kern.=debug |/usr/adm/debug
|
kern.=debug |/var/log/debug
|
||||||
.Ed
|
.Ed
|
||||||
.Sh CONCERNS
|
.Sh CONCERNS
|
||||||
There is probably one important consideration when installing this
|
There is probably one important consideration when installing this
|
||||||
|
Loading…
x
Reference in New Issue
Block a user