syslog.confチートシート

syslog

毎回syslog.confの文法を思い出すのが面倒になってきたので，チートシートを作ってみました．syslog.conf(5)は読みにくいし．

とりあえずDebian Sargeのsyslog.conf(5)を参考に作成した．

■syslog.conf cheat sheet (for Linux)
1行1ルール．selectorにマッチするruleのactionを全て実行する．

<rule> ::= <selector><delimiter><action>
<delimiter> ::= (TAB | SPACE)+
  ※マッチする全てのselectorのactionを実行する
  ※デリミタはTAB区切り推奨! (古いUNIXのsyslogdはSPACEがダメな事もあるよ!)

= example
*.info;\
  mail.none  /var/log/info-expect-mail.log

= selector
<selector> ::= <selector_elem>
<selector_elem> ::= <facility>.<priority>[;<selector_elem>]*
  ※後続のselector_elemは先行selector_elemを上書き

<facility>:
  auth, authpriv, cron, daemon, kern, lpr, mail, mark, news, syslog,
  user, uucp, local0-7
  *: 全部

<priority>:
  debug, info, notice, warning, err, warn, panic
  包含関係あり: debug⊃info⊃notice⊃warning⊃err⊃warn⊃panic
  none: そのfacilityを除外

  <facility>.prio1,prio2,...
    -> <facility>.prio1;<facility>.prio2と同じ

= action
  /full/path/of/logfile
  -/unbuffered/output/improve/performance/but/sometime/lost/log
  |/named/pipe/create/before/syslogd/starting
  /dev/tty1
  /dev/console
  @loghost.example.com
  @192.168.0.1
  root,user1  (write(1) to the specified users)
  *  (wall(1))

= Extensions
== Linux
<priority>:
  <facility>.=info  (only records info level messages.)
  <facility>.!info  (only records debug.  ignore higher than info level.)
  <facility>.!=info (ignore info.)

= How to restart syslogd with the new configuration
== Linux
  % sudo kill -HUP `cat /var/run/syslogd.pid`
== FreeBSD
  % sudo /etc/rc.d/syslogd reload
   or
  % sudo /etc/rc.d/syslogd restart