HardenedBSD/etc/syslog.conf

# $FreeBSD$
#
#	Spaces ARE valid field separators in this file. However,
#	other *nix-like systems still insist on using tabs as field
#	separators. If you are sharing this file between systems, you
#	may want to use only tabs as field separators here.
#	Consult the syslog.conf(5) manpage.
*.err;kern.debug;auth.notice;mail.crit		/dev/console
*.notice;kern.debug;lpr.info;mail.crit;news.err	/var/log/messages
security.*					/var/log/security
auth.info;authpriv.info				/var/log/auth.log
mail.info					/var/log/maillog
lpr.info					/var/log/lpd-errs
cron.*						/var/log/cron
*.emerg						*
# uncomment this to log all writes to /dev/console to /var/log/console.log
#console.info					/var/log/console.log
# uncomment this to enable logging of all log messages to /var/log/all.log
# touch /var/log/all.log and chmod it to mode 600 before it will work
#*.*						/var/log/all.log
# uncomment this to enable logging to a remote loghost named loghost
#*.*						@loghost
# uncomment these if you're running inn
# news.crit					/var/log/news/news.crit
# news.err					/var/log/news/news.err
# news.notice					/var/log/news/news.notice
!startslip
*.*						/var/log/slip.log
!ppp
*.*						/var/log/ppp.log
$Id$ -> $FreeBSD$ 1999-08-28 01:37:10 +02:00			`# $FreeBSD$`
Add Id keywords 1998-09-02 03:34:57 +02:00			`#`
Note in the comments that it is possible, but not recommended to use spaces instead of tabs in this file. This matches the description in the manpage. PR: 25945 Submitted by: T. William Wells <bill@twwells.com> 2001-03-31 06:41:24 +02:00			`# Spaces ARE valid field separators in this file. However,`
			`# other *nix-like systems still insist on using tabs as field`
			`# separators. If you are sharing this file between systems, you`
			`# may want to use only tabs as field separators here.`
- Add a couple comment lines to note that spaces are not allowed as field separators. PR: conf/8162 Submitted by: Sheldon Hearn <sheldonh@axl.training.iafrica.com> 1998-10-14 23:59:55 +02:00			`# Consult the syslog.conf(5) manpage.`
Initial import of 386BSD 0.1 othersrc/etc 1993-06-20 15:41:45 +02:00			`*.err;kern.debug;auth.notice;mail.crit /dev/console`
auth.debug should not be sent to root realtime news.notice info should not be sent to /var/log/messages, as news has its own set of logs and notice is overused by inn added entries for newsservers (but they're commented out) 1996-11-06 23:27:04 +01:00			`*.notice;kern.debug;lpr.info;mail.crit;news.err /var/log/messages`
Clean up logging of security information a bit: o Introduce /var/log/authentication.log, which will be the target for auth.info and authpriv.info by default. Rotate on the same schedule as most other logs. Create at installation. o Remove logging of auth.info from /var/log/security.log, which will return to being only for security feature subsystems (such as ipfw, and so on). This creates a special authentication log, which can now be searched by scripts for authentication events. 2002-03-11 20:26:29 +01:00			`security.* /var/log/security`
Turns out everyone is a lot lazier than I thought. Spell 'authentication.log' as 'auth.log'. This is also more consistent with syslog facility names. Sigh. :-) Submitted by: asmodai, aeonflux, green, .... 2002-03-11 20:34:57 +01:00			`auth.info;authpriv.info /var/log/auth.log`
Initial import of 386BSD 0.1 othersrc/etc 1993-06-20 15:41:45 +02:00			`mail.info /var/log/maillog`
			`lpr.info /var/log/lpd-errs`
Move /var/cron/log to /var/log/cron 1999-09-06 22:10:27 +02:00			`cron.* /var/log/cron`
Initial import of 386BSD 0.1 othersrc/etc 1993-06-20 15:41:45 +02:00			`.emerg `
Log the console output to "/var/log/console.log", not "/var/log/console" (MFC candidate) 2001-02-17 21:27:58 +01:00			`# uncomment this to log all writes to /dev/console to /var/log/console.log`
			`#console.info /var/log/console.log`
Add two commented out syslog.conf entries, one to demonstrate the use of an all.log for logging all messages, and one to demonstrate use of loghosts. Also, a matching entry in newsyslog.conf for all.log. Per request of Garrett Wollman, also modified the maillog entry to use the @T newsyslog time specification mechanism. Because newsyslog doesn't support the mod date specification machanism, couldn't change other entries that required more than one execution a month, but less than once a day. Approved by: jkh Reviewed by: freebsd-security 2000-02-08 22:57:28 +01:00			`# uncomment this to enable logging of all log messages to /var/log/all.log`
Explain that /var/log/all.log needs to be touched and chmod'd 'ere it can be used. PR: 17022 Submitted by: Niels Christian Bank-Pedersen <ncbp@bank-pedersen.dk> MFC after: 1 week 2001-10-28 14:41:30 +01:00			`# touch /var/log/all.log and chmod it to mode 600 before it will work`
Add two commented out syslog.conf entries, one to demonstrate the use of an all.log for logging all messages, and one to demonstrate use of loghosts. Also, a matching entry in newsyslog.conf for all.log. Per request of Garrett Wollman, also modified the maillog entry to use the @T newsyslog time specification mechanism. Because newsyslog doesn't support the mod date specification machanism, couldn't change other entries that required more than one execution a month, but less than once a day. Approved by: jkh Reviewed by: freebsd-security 2000-02-08 22:57:28 +01:00			`#. /var/log/all.log`
			`# uncomment this to enable logging to a remote loghost named loghost`
			`#. @loghost`
auth.debug should not be sent to root realtime news.notice info should not be sent to /var/log/messages, as news has its own set of logs and notice is overused by inn added entries for newsservers (but they're commented out) 1996-11-06 23:27:04 +01:00			`# uncomment these if you're running inn`
			`# news.crit /var/log/news/news.crit`
			`# news.err /var/log/news/news.err`
			`# news.notice /var/log/news/news.notice`
Put startslip syslog messages into separate file Increase rotating log sizes in newsyslog.conf to reflect more common case 1996-01-07 01:52:50 +01:00			`!startslip`
			`. /var/log/slip.log`
Add ppp.log 1997-06-10 22:40:22 +02:00			`!ppp`
			`. /var/log/ppp.log`