[-l lib_path] [-u] [-module_name {0|1}]

DESCRIPTION

     The syslogd server receives and processes log messages.  Several modules
     receive input messages through various channels, including UNIX domain
     sockets associated with the syslog(3), asl(3), and kernel printf APIs,
     and optionally from a UDP socket if the ``udp_in'' module is enabled.

     The Apple System Log facility comprises the asl(3) API, a new syslogd
     server, and the syslog(1) command-line utility.  The system supports
     structured and extensible messages, permitting advanced message browsing
     and management through search APIs and other components of the Apple sys-
     tem log facility.

     Log messages are retained in a data store, subject to pruning and input
     filtering as described below, to simplify the task of locating log mes-
     sages and to facilitate browsing and searching.  The data store is
     intended to become a replacement for the numerous log files that are cur-
     rently found in various locations on the system.  Those files will be
     phased out in future versions of Mac OS.

     The following options are recognized:

     -d      Run syslogd in debugging mode.  The server stays attached to the
             controlling terminal and prints debugging messages.

     -D      Start as a daemon.  This option forces syslogd to fork and have
             the child process become a daemon.  Since syslogd is started by
             launchd, this is not normally required.

     -m      Set the number of minutes between ``mark'' messages.  The default
             is 20 minutes.  The ``mark'' facility is disabled if the setting
             is zero minutes.

     -p      syslogd saves log messages in a data store that may be searched
             using the syslog(1) utility or with the asl(3) API.  The data
             store is pruned daily by the /etc/daily cron job to keep it from
             growing without bound.  Since many systems are shut down
             overnight (when the daily cron job runs), the data store is also
             pruned shortly after syslogd starts up as the system boots.  By
             default, log messages in the data store that are more than 7 days
             old are removed.  The setting of the -p prune_days overrides the
             default.  A setting of zero days disables pruning of the data
             store when syslogd starts up.

     -c      Sets a cutoff filter for log priorities for messages to be
             retained in the log message data store.  The value of log_cutoff
             must be between 0 and 7, corresponding to log priorities
             LOG_EMERG or ASL_LEVEL_EMERG and LOG_DEBUG or ASL_LEVEL_DEBUG as
             defined in the syslog(3) and asl(3) header files.  Received mes-
             sages with a priority or level value greater than the cutoff will
             not be saved in the data store.  The default filter will retain

     -u      Enables the ``udp_in'' module, configuring syslogd to act as a
             network log message receiver.  The server will receive messages
             on the standard ``syslog'' UDP port.  Note that this opens the
             server to potential denial-of-service attacks, as a malicious
             remote sender can flood the server with messages.  The -u option
             is equivalent to using the -udp_in 1 option.

     The remaining options of the form -module_name {0|1} may be used to dis-
     able (0) or enable (1) the action of several of internal modules.

     -asl_in      The ``asl_in'' module receives log messages on the UNIX
                  domain socket associated with the asl(3) API.  The module
                  may be disabled using -asl_in 0.  The module is normally
                  enabled.

     -asl_action  The ``asl_action'' module examines the stream of received
                  log messages and acts upon them according to the rules spec-
                  ified in the file /etc/asl.conf.  See asl.conf(5) for
                  details.

     -klog_in     The ``klog_in'' module receives log messages on the UNIX
                  domain socket associated with the kernel logging API.  The
                  module may be disabled using -klog_in 0.  The module is nor-
                  mally enabled.

     -bsd_in      The ``bsd_in'' module receives log messages on the UNIX
                  domain socket associated with the syslog(3) API.  The module
                  may be disabled using -bsd_in 0.  The module is normally
                  enabled.

     -bsd_out     The ``bsd_out'' module examines the stream of received log
                  messages and acts upon them according to the rules specified
                  in the file /etc/syslog.conf.  See syslog.conf(5) for
                  details.  This module exists for backward compatibility with
                  previous syslogd implementations.  Apple encourages use of
                  the syslog(1) and asl(3) search APIs over the use of the log
                  files that are specified in the /etc/syslog.conf file.
                  Future versions of Mac OS will move functions that are cur-
                  rently handled by the ``bsd_out'' module to the
                  ``asl_action'' module.

     -udp_in      The ``udp_in'' module receives log messages on the UDP
                  socket associated with the Internet syslog message protocol.
                  The module may be enabled using -udp_in 1.  The module is
                  normally disabled.  This module may also be enabled using
                  the -u option.

     syslogd initializes its built-in modules and loads plug-ins during its
     start-up.  The data store is pruned approximately 5 minutes after
     startup.


     The Apple System Log facility was introduced in Mac OS X 10.4.

Mac OS X                       October 18, 2004                       Mac OS X