|
|
This manual page is for Mac OS X version 10.6.3If you are running a different version of Mac OS X, view the documentation locally:
Reading manual pagesManual pages are intended as a quick reference for people who already understand a technology.
|
asl.conf(5) BSD File Formats Manual asl.conf(5)
NAME
asl.conf -- configuration file for syslogd(8) and aslmanager(8)
DESCRIPTION
The syslogd(8) server reads the asl.conf file at startup, and re-reads the file whenever it received a
HUP signal. The aslmanager(8) daemon reads the file when it starts. See the ASLMANAGER PARAMETER SET-TINGS SETTINGS
TINGS section below for details on those parameter settings.
The file may contain parameter settings, used in place of (and which will override) command-line
options, and may contain query-action rules that trigger specific actions when syslogd recieves mes-sages messages
sages that match the query pattern.
Parameter setting lines in the configuration file begin with an equal sign ("="), and are generally of
the form:
= parameter_name value ...
Most parameter settings require a single value, although some may take several values. See the PARAME-TER PARAMETER
TER SETTINGS section below for details.
Query-action rules in the file begin with a question-mark ("?") or a "Q", and generally have the form:
? query action ...
Specific actions may be followed by optional arguments. See the QUERY-ACTION RULES section below for
details.
PARAMETER SETTINGS
The following parameter-settings are recognized by syslogd.
debug Enables or disables internal debugging output. This is probably of little
interest to most users. The debug parameter requires a value of "1" to enable
debug output, or a value of "0" to disable it. An option file name may follow
the "0" or "1". If a file name is provided, debug messages are written to that
file. Otherwise, debug writes are treated as log messages.
cutoff Sets the ASL data store cutoff level, given as an integer in the range 0 to 7
as an argument. The cutoff level is 7 by default, allowing any message that
matches a "store" action (see QUERY-ACTION RULES below) to be saved. Setting
the cutoff to a lower value will prevent messages with log priority levels
numerically greater that the specified cutoff from being saved in the ASL data
store.
mark_time Sets the time interval for the mark facility. The default is 0 seconds, which
indicates that mark messages are not generated.
dup_delay Sets the maximum time that the bsd_out module will allow before writing a "last
message repeated <N> times" message in a log file specified in /etc/sys-log.conf. /etc/syslog.conf.
log.conf. The default is 30 seconds.
utmp_ttl Sets the time-to-live for messages used by the utmp, wtmp, and lastlog subsys-tems. subsystems.
tems. The default is 31622400 seconds (approximately 1 year).
fs_ttl Sets the time-to-live for filesystem error messages generated by the kernel.
The default is 31622400 seconds (approximately 1 year).
mps_limit Sets the per-process message per second quota. The default is value is 500. A
value of 0 disables the quota mechanism.
max_file_size Sets the maximum file size for individual files in the ASL data store. The
default is 25600000 bytes.
QUERY-ACTION RULES
Rules contain three components: a query; an action; and optionally, parameters specific to that action.
For example:
? [= Sender foobar] [<= Level error] notify com.apple.foobar
Query Format
Queries comprise one or more message matching components, each of which has the form:
[OP KEY VAL]
OP is a comparison operator. It can have the following values:
T true (always matches)
= equal
! not equal
> greater than
>= greater than or equal to
< less than
<= less than or equal to
It can also be preceded by one or more modifiers:
C casefold
N numeric comparison
S substring
A prefix
Z suffix
KEY and VAL are message keys and values. For example
[= Sender foobar]
matches any message with key="Sender" and val="foobar". The query
[CA= Color gr]
matches any message with key=Color and val beginning with the letters GR, Gr, gr, or gR (C meaning
casefold, A meaning prefix). The example query above,
[= Sender foobar] [N< Level 3]
matches any message from "foobar" with a level numerically less than 3 (string values are converted to
integers, and the comparison is done on the integer values). Note that the string values may be used
equivalently for the Level key, so the example above may also be written as:
[= Sender foobar] [< Level Error]
String values for levels may be any of the set "emergency", "alert", "critical", "error", "warning",
"notice", "info", or "debug". These strings may be upper, lower, or mixed case.
The "T" operator is useful to test for the presence of a particular key.
[T Flavor]
Will match any message that has a "Flavor" key, regardless of its value.
Actions
The following actions are available.
notify Causes syslogd to post a notification with notify_post(). The notification key
must appear as a single parameter following the "notify" action.
access Sets read access controls for messages that match the associated query pattern.
syslogd will restrict read access to matching messages to a specific user and
group. The user ID number and group ID number must follow the "access" keyword
as parameters.
store Causes syslogd to save matching messages, either in the main ASL data store, or
in a separate log message data store file is a file name is given as a parame-
ter. A separate data store file may be accessed using the syslog command line
utility. A new file will be created if one does not exist. If a new file is
being created, the UID, GID, and mode of the file may be specified using the
options "uid=UUU", "gid=GGG", and "mode=MMMM", where UUU and GGG are a user ID
and group ID, and MMMM is a mode specification of the form "0644" (for an octal
number) or DDD for a decimal number.
Two other optional parameters may also follow the pathname.
By default, syslogd will open the database, save a matching message, and then
close the database. If a high volume of messages is expected, specifying the
"stayopen" option will improve performance.
Specifying "exclude_asldb" will cause syslogd to save matching messages in the
specificed file, but exclude them from the main ASL data store.
Note that if the configuration file contains no matching rules for the ASL data
store, then syslogd will save all messages, subject to filtering in accordance
with the log cutoff level.
store_directory Causes matching messages to be stored in a log message data store file in a sep-arate separate
arate directory. The directory path name must follow as the first parameter.
The named directory must exist. syslogd will not ceate the directory path.
Messages saved to a store directory are saved in files that are named
"yyyy.mm.dd.asl", where "yyyy", "mm", and "dd" are the year, month (01 to 12)
and day of the month (01 to 31) associated with matching messages. This has the
effect of saving messages in a separate file for each day.
The "exclude_asldb", "uid=UUU", "gid=GGG", and "mode=MMMM" options available for
the "store" action may also be specified for a store directory. The uid, gid,
and mode specification will be used when the individual daily store files are
created.
broadcast Causes syslogd to write the text of matching messages to all terminal windows.
If optional text follows the "broadcast" keyword, then that text is written
rather that the matching message text.
ignore Causes a matching message to be ignored in all subsequent matching rules.
ASLMANAGER PARAMETER SETTINGS
The following parameter-settings are recognized by aslmanager.
aslmanager_debug Enables or disables internal debugging output. This is probably of little
interest to most users. The debug parameter requires a value of "1" to enable
debug output, or a value of "0" to disable it. Debug messages are sent to
syslogd.
store_ttl Sets the time-to-live in days for messages in the syslog data store. The
default is 7 days.
max_store_size Sets the maximum size for for the ASL data store. The default is 150000000
bytes.
archive Enables or disables archiving. The archive parameter requires a value of "1"
to enable archiving, or a value of "0" to disable it. An option archive direc-tory directory
tory path may follow the "0" or "1". If enabled, files removed from the ASL
data store are moved to the archive directory. The default archive directory
path is /var/log/asl.archive.
store_path The data store path used by aslmanager. The default is /var/log/asl. Note
that this parameter is ignored by syslogd.
archive_mode Files copied to the archive will be given the specified access mode. The
default is 0400, so archive files will only be readable by root.
SEE ALSO
asl(3), notify(3), syslog(1), aslmanager(8), syslogd(8).
Mac OS X Sept 19, 2008 Mac OS X
|
The way to report a problem with this manual page depends on the type of problem: