NEWSYSLOG.CONF(5) BSD File Formats Manual NEWSYSLOG.CONF(5)
newsyslog.conf -- newsyslog(8) configuration file
The newsyslog.conf file is used to set log file rotation configuration for the newsyslog(8)
utility. Configuration may designate that logs are rotated based on size, last rotation
time, or time of day. The newsyslog.conf file can also be used to designate secure permis-
sions to log files at rotation time. During initialization, newsyslog(8) reads a configura-
tion file, normally /etc/newsyslog.conf, to determine which logs may potentially be rotated
and archived. Each line has five mandatory fields and four optional fields, separated with
whitespace. Blank lines or lines beginning with '#' are ignored. If '#' is placed in the
middle of the line, the '#' character and the rest of the line after it is ignored. To pre-
vent special meaning, the '#' character may be escaped with '\'; in this case preceding '\'
is removed and '#' is treated as an ordinary character. The fields of the configuration
file are as follows:
Name of the system log file to be archived, or one of the literal strings
``<default>'', or ``<include>''. The special default entry will only be used if a
log file name is given as a command line argument to newsyslog(8), and if that log
file name is not matched by any other line in the configuration file. The include
entry is used to include other configuration files and supports globbing.
This optional field specifies the owner and group for the archive file. The ':' is
essential regardless if the owner or group field is left blank or contains a value.
The field may be numeric, or a name which is present in /etc/passwd or /etc/group.
mode Specify the file mode of the log file and archives.
count Specify the maximum number of archive files which may exist. This does not consider
the current log file.
size When the size of the log file reaches size in kilobytes, the log file will be
trimmed as described above. If this field contains an asterisk ('*'), the log file
will not be trimmed based on size.
when The when field may consist of an interval, a specific time, or both. If the when
field contains an asterisk ('*'), log rotation will solely depend on the contents of
the size field. Otherwise, the when field consists of an optional interval in
hours, usually followed by an '@'-sign and a time in restricted ISO 8601 format.
Additionally, the format may also be constructed with a '$' sign along with a rota-
tion time specification of once a day, once a week, or once a month.
Time based trimming happens only if newsyslog(8) is run within one hour of the spec-
ified time. If an interval is specified, the log file will be trimmed if that many
hours have passed since the last rotation. When both a time and an interval are
specified then both conditions must be satisfied for the rotation to take place.
There is no provision for the specification of a timezone. There is little point in
specifying an explicit minutes or seconds component in the current implementation,
since the only comparison is ``within the hour''.
ISO 8601 restricted time format:
The lead-in character for a restricted ISO 8601 time is an '@' sign. The particular
format of the time in restricted ISO 8601 is: [[[[[cc]yy]mm]dd][T[hh[mm[ss]]]]].
Optional date fields default to the appropriate component of the current date;
optional time fields default to midnight; hence if today is January 22, 1999, the
following date specifications are all equivalent:
Day, week, and month time format:
The lead-in character for day, week, and month specification is a '$' sign. The
particular format of day, week, and month specification is: [Dhh], [Ww[Dhh]], and
[Mdd[Dhh]], respectively. Optional time fields default to midnight. The ranges for
day and hour specifications are:
hh hours, range 0..23
w day of week, range 0..6, 0 = Sunday
dd day of month, range 1..31, or one of the letters 'L' or 'l' to specify
the last day of the month.
$D0 rotate every night at midnight (same as @T00)
$D23 rotate every day at 23:00 (same as @T23)
$W0D23 rotate every week on Sunday at 23:00
$W5D16 rotate every week on Friday at 16:00
$M1D0 rotate at the first day of every month at midnight (i.e., the start of
the day; same as @01T00)
$M5D6 rotate on every 5th day of month at 6:00 (same as @05T06)
flags This optional field is made up of one or more characters that specify any special
processing to be done for the log files matched by this line. The following are
B indicates that the log file is a binary file, or has some special format.
Usually newsyslog(8) inserts an ASCII message into a log file during rota-
tion. This message is used to indicate when, and sometimes why the log file
was rotated. If B is specified, then that informational message will not be
inserted into the log file.
C indicates that the log file should be created if it does not already exist,
and if the -C option was also specified on the command line.
D indicates that newsyslog(8) should set the UF_NODUMP flag when creating a
new version of this log file. This option would affect how the dump(8) com-
mand treats the log file when making a file system backup.
G indicates that the specified logfile_name is a shell pattern, and that
newsyslog(8) should archive all filenames matching that pattern using the
other options on this line. See glob(3) for details on syntax and matching
J indicates that newsyslog(8) should attempt to save disk space by compressing
the rotated log file using bzip2(1).
X indicates that newsyslog(8) should attempt to save disk space by compressing
the rotated log file using xz(1).
N indicates that there is no process which needs to be signaled when this log
file is rotated.
R if this flag is set the newsyslog(8) will run shell command defined in
path_to_pid_cmd_file after rotation instead of trying to send signal to a
process id stored in the file.
U indicates that the file specified by path_to_pid_cmd_file will contain the
ID for a process group instead of a process. This option also requires that
the first line in that file be a negative value to distinguish it from a
Z indicates that newsyslog(8) should attempt to save disk space by compressing
the rotated log file using gzip(1).
- a minus sign will not cause any special processing, but it can be used as a
placeholder to create a flags field when you need to specify any of the fol-
This optional field specifies the file name containing a daemon's process ID or to
find a group process ID if the U flag was specified. If this field is present, a
signal_number is sent to the process ID contained in this file. If this field is
not present and the N flag has not been specified, then a SIGHUP signal will be sent
to syslogd(8) or to the process id found in the file specified by newsyslog(8)'s -S
switch. This field must start with '/' in order to be recognized properly. When
used with the R flag, the file is treated as a path to a binary to be executed by
the newsyslog(8) after rotation instead of sending the signal out.
This optional field specifies the signal number that will be sent to the daemon
process (or to all processes in a process group, if the U flag was specified). If
this field is not present, then a SIGHUP signal will be sent.
The following is an example of the ``<include>'' entry:
bzip2(1), gzip(1), xz(1), syslog(3), chown(8), newsyslog(8), syslogd(8)
This manual page first appeared in FreeBSD 4.10.
BSD March 21, 2012 BSD