HardenedBSD/etc/syslog.conf

# $FreeBSD$
#
#	Spaces ARE valid field separators in this file. However,
#	other *nix-like systems still insist on using tabs as field
#	separators. If you are sharing this file between systems, you
#	may want to use only tabs as field separators here.
#	Consult the syslog.conf(5) manpage.
*.err;kern.warning;auth.notice;mail.crit		/dev/console
*.notice;authpriv.none;kern.debug;lpr.info;mail.crit;news.err	/var/log/messages
security.*					/var/log/security
auth.info;authpriv.info				/var/log/auth.log
mail.info					/var/log/maillog
lpr.info					/var/log/lpd-errs
ftp.info					/var/log/xferlog
cron.*						/var/log/cron
*.=debug					/var/log/debug.log
*.emerg						*
# uncomment this to log all writes to /dev/console to /var/log/console.log
#console.info					/var/log/console.log
# uncomment this to enable logging of all log messages to /var/log/all.log
# touch /var/log/all.log and chmod it to mode 600 before it will work
#*.*						/var/log/all.log
# uncomment this to enable logging to a remote loghost named loghost
#*.*						@loghost
# uncomment these if you're running inn
# news.crit					/var/log/news/news.crit
# news.err					/var/log/news/news.err
# news.notice					/var/log/news/news.notice
!ppp
*.*						/var/log/ppp.log
!*
$Id$ -> $FreeBSD$ 1999-08-28 01:37:10 +02:00			`# $FreeBSD$`
Add Id keywords 1998-09-02 03:34:57 +02:00			`#`
Note in the comments that it is possible, but not recommended to use spaces instead of tabs in this file. This matches the description in the manpage. PR: 25945 Submitted by: T. William Wells <bill@twwells.com> 2001-03-31 06:41:24 +02:00			`# Spaces ARE valid field separators in this file. However,`
			`# other *nix-like systems still insist on using tabs as field`
			`# separators. If you are sharing this file between systems, you`
			`# may want to use only tabs as field separators here.`
- Add a couple comment lines to note that spaces are not allowed as field separators. PR: conf/8162 Submitted by: Sheldon Hearn <sheldonh@axl.training.iafrica.com> 1998-10-14 23:59:55 +02:00			`# Consult the syslog.conf(5) manpage.`
Fix a terrible braino in last commit. Put kern.debug back to /var/log/messages and do exactly what last commit message described. 2005-03-12 13:31:16 +01:00			`*.err;kern.warning;auth.notice;mail.crit /dev/console`
			`*.notice;authpriv.none;kern.debug;lpr.info;mail.crit;news.err /var/log/messages`
Clean up logging of security information a bit: o Introduce /var/log/authentication.log, which will be the target for auth.info and authpriv.info by default. Rotate on the same schedule as most other logs. Create at installation. o Remove logging of auth.info from /var/log/security.log, which will return to being only for security feature subsystems (such as ipfw, and so on). This creates a special authentication log, which can now be searched by scripts for authentication events. 2002-03-11 20:26:29 +01:00			`security.* /var/log/security`
Turns out everyone is a lot lazier than I thought. Spell 'authentication.log' as 'auth.log'. This is also more consistent with syslog facility names. Sigh. :-) Submitted by: asmodai, aeonflux, green, .... 2002-03-11 20:34:57 +01:00			`auth.info;authpriv.info /var/log/auth.log`
Initial import of 386BSD 0.1 othersrc/etc 1993-06-20 15:41:45 +02:00			`mail.info /var/log/maillog`
			`lpr.info /var/log/lpd-errs`
Rename the ftp log filename for compatability with OpenBSD and NetBSD. Requested by: ru 2002-09-21 14:07:35 +02:00			`ftp.info /var/log/xferlog`
Move /var/cron/log to /var/log/cron 1999-09-06 22:10:27 +02:00			`cron.* /var/log/cron`
Make sure debug.log only gets debugging messages. 2003-04-23 15:08:31 +02:00			`*.=debug /var/log/debug.log`
Initial import of 386BSD 0.1 othersrc/etc 1993-06-20 15:41:45 +02:00			`.emerg `
Log the console output to "/var/log/console.log", not "/var/log/console" (MFC candidate) 2001-02-17 21:27:58 +01:00			`# uncomment this to log all writes to /dev/console to /var/log/console.log`
			`#console.info /var/log/console.log`
Add two commented out syslog.conf entries, one to demonstrate the use of an all.log for logging all messages, and one to demonstrate use of loghosts. Also, a matching entry in newsyslog.conf for all.log. Per request of Garrett Wollman, also modified the maillog entry to use the @T newsyslog time specification mechanism. Because newsyslog doesn't support the mod date specification machanism, couldn't change other entries that required more than one execution a month, but less than once a day. Approved by: jkh Reviewed by: freebsd-security 2000-02-08 22:57:28 +01:00			`# uncomment this to enable logging of all log messages to /var/log/all.log`
Explain that /var/log/all.log needs to be touched and chmod'd 'ere it can be used. PR: 17022 Submitted by: Niels Christian Bank-Pedersen <ncbp@bank-pedersen.dk> MFC after: 1 week 2001-10-28 14:41:30 +01:00			`# touch /var/log/all.log and chmod it to mode 600 before it will work`
Add two commented out syslog.conf entries, one to demonstrate the use of an all.log for logging all messages, and one to demonstrate use of loghosts. Also, a matching entry in newsyslog.conf for all.log. Per request of Garrett Wollman, also modified the maillog entry to use the @T newsyslog time specification mechanism. Because newsyslog doesn't support the mod date specification machanism, couldn't change other entries that required more than one execution a month, but less than once a day. Approved by: jkh Reviewed by: freebsd-security 2000-02-08 22:57:28 +01:00			`#. /var/log/all.log`
			`# uncomment this to enable logging to a remote loghost named loghost`
			`#. @loghost`
auth.debug should not be sent to root realtime news.notice info should not be sent to /var/log/messages, as news has its own set of logs and notice is overused by inn added entries for newsservers (but they're commented out) 1996-11-06 23:27:04 +01:00			`# uncomment these if you're running inn`
			`# news.crit /var/log/news/news.crit`
			`# news.err /var/log/news/news.err`
			`# news.notice /var/log/news/news.notice`
Add ppp.log 1997-06-10 22:40:22 +02:00			`!ppp`
			`. /var/log/ppp.log`
syslog.conf: pop up from logging only ppp messages at the end of file This allows to append custom rules at the end of the file without risk of confusion that can result when one misses default !ppp line and doesn't add another program specification and thus subsequent selector(s) would belong to ppp program block. Requested by: marck Submitted by: marck Approved by: jhb (mentor) 2009-06-11 17:07:02 +02:00			`!*`