syslog-385.tar.gz

[apple/syslog.git] / syslogd.tproj / syslog.conf.5

diff --git a/syslogd.tproj/syslog.conf.5 b/syslogd.tproj/syslog.conf.5
index e3b88b930bf95913cd7998812ead48e6373ab78a..303d91770b51e44c9861e6b404f3ade0485801f4 100644 (file)
--- a/syslogd.tproj/syslog.conf.5
+++ b/syslogd.tproj/syslog.conf.5
@@ -76,8 +76,8 @@ are case insensitive.
 .Pp
 The
 .Em facility
-describes the part of the system generating the message, and is one of
-the following keywords: auth, authpriv, cron, daemon, kern, lpr, mail,
+describes the part of the system generating the message.
+Legacy facility names are: auth, authpriv, cron, daemon, kern, lpr, mail,
 mark, news, syslog, user, uucp and local0 through local7.
 These keywords (with the exception of mark) correspond to the
 similar
@@ -88,6 +88,27 @@ and
 .Xr syslog 3
 library routines.
 .Pp
+Apple System Log (ASL) messages, sent using the
+.Xr asl 3
+library routines permit the facility name to be an arbitrary string,
+although users of the system are encouraged to use a 
+.Dq reverse ICANN
+naming convention, for example
+.Dq com.apple.system.syslog .
+Since these facility names may contain dot characters, the names may be enclosed in
+either singe quote or double quote characters.
+.Pp
+If 
+.Em facility
+is terminated by an asterisk (``*''),
+then facility names are matched using the prefix characters preceeding the asterisk.
+For example,
+.Pp
+.Dq 'com.apple.abc.*'
+.Pp
+matches any facility with the prefix ``com.apple.abc.''.
+These wildcard facility names typically must be enclosed in single or double quotes characters.
+.Pp
 The
 .Em level
 describes the severity of the message, and is a keyword from the
@@ -221,6 +242,7 @@ The effects of multiple selectors are sometimes not intuitive.
 For example ``mail.crit,*.err'' will select ``mail'' facility messages at
 the level of ``err'' or higher, not at the level of ``crit'' or higher.
 .Sh SEE ALSO
+.Xr asl 3 ,
 .Xr syslog 3 ,
 .Xr syslogd 8
 .Sh HISTORY