NEWSYSLOG.CONF(5) BSD File Formats Manual NEWSYSLOG.CONF(5)
newsyslog.conf -- newsyslog(8) configuration file
The newsyslog.conf file is used to set log file rotation configuration for the newsyslog(8)
utility. Configuration may designate that logs are rotated based on size, last rotation
time, or time of day. The newsyslog.conf file can also be used to designate secure permis-
sions to log files at rotation time. During initialization, newsyslog(8) reads a configura-
tion file, normally /etc/newsyslog.conf, to determine which logs may potentially be rotated
and archived. Each line has five mandatory fields and four optional fields, separated with
whitespace. Blank lines or lines beginning with '#' are ignored. If '#' is placed in the
middle of the line, the '#' character and the rest of the line after it is ignored. To pre-
vent special meaning, the '#' character may be escaped with '\'; in this case preceding '\'
is removed and '#' is treated as an ordinary character. The fields of the configuration
file are as follows:
Name of the system log file to be archived, or the literal string ``<default>''.
The special default entry will only be used if a log file name is given as a command
line argument to newsyslog(8), and if that log file name is not matched by any other
line in the configuration file.
This optional field specifies the owner and group for the archive file. The ':' is
essential regardless if the owner or group field is left blank or contains a value.
The field may be numeric, or a name which is present in /etc/passwd or /etc/group.
mode Specify the file mode of the log file and archives.
count Specify the maximum number of archive files which may exist. This does not consider
the current log file.
size When the size of the log file reaches size in kilobytes, the log file will be
trimmed as described above. If this field contains an asterisk ('*'), the log file
will not be trimmed based on size.
when The when field may consist of an interval, a specific time, or both. If the when
field contains an asterisk ('*'), log rotation will solely depend on the contents of
the size field. Otherwise, the when field consists of an optional interval in
hours, usually followed by an '@'-sign and a time in restricted ISO 8601 format.
Additionally, the format may also be constructed with a '$' sign along with a rota-
tion time specification of once a day, once a week, or once a month.
If a time is specified, the log file will only be trimmed if newsyslog(8) is run
within one hour of the specified time. If an interval is specified, the log file
will be trimmed if that many hours have passed since the last rotation. When both a
time and an interval are specified then both conditions must be satisfied for the
rotation to take place.
There is no provision for the specification of a timezone. There is little point in
specifying an explicit minutes or seconds component in the current implementation,
since the only comparison is ``within the hour''.
ISO 8601 restricted time format:
The lead-in character for a restricted ISO 8601 time is an '@' sign. The particular
format of the time in restricted ISO 8601 is: [[[[[cc]yy]mm]dd][T[hh[mm[ss]]]]].
Optional date fields default to the appropriate component of the current date;
optional time fields default to midnight; hence if today is January 22, 1999, the
following date specifications are all equivalent:
Day, week, and month time format:
The lead-in character for day, week, and month specification is a '$' sign. The
particular format of day, week, and month specification is: [Dhh], [Ww[Dhh]], and
[Mdd[Dhh]], respectively. Optional time fields default to midnight. The ranges for
day and hour specifications are:
hh hours, range 0..23
w day of week, range 0..6, 0 = Sunday
dd day of month, range 1..31, or one of the letters 'L' or 'l' to specify
the last day of the month.
$D0 rotate every night at midnight (same as @T00)
$D23 rotate every day at 23:00 (same as @T23)
$W0D23 rotate every week on Sunday at 23:00
$W5D16 rotate every week on Friday at 16:00
$M1D0 rotate at the first day of every month at midnight (i.e., the start of
the day; same as @01T00)
$M5D6 rotate on every 5th day of month at 6:00 (same as @05T06)
flags This optional field is made up of one or more characters that specify any special
processing to be done for the log files matched by this line. The following are
B indicates that the log file is a binary file, or has some special format.
Usually newsyslog(8) inserts an ASCII message into a log file during rota-
tion. This message is used to indicate when, and sometimes why the log file
was rotated. If B is specified, then that informational message will not be
inserted into the log file.
C indicates that the log file should be created if it does not already exist,
and if the -C option was also specified on the command line.
D indicates that newsyslog(8) should set the UF_NODUMP flag when creating a
new version of this log file. This option would affect how the dump(8) com-
mand treats the log file when making a file system backup.
G indicates that the specified logfile_name is a shell pattern, and that
newsyslog(8) should archive all filenames matching that pattern using the
other options on this line. See glob(3) for details on syntax and matching
J indicates that newsyslog(8) should attempt to save disk space by compressing
the rotated log file using bzip2(1).
N indicates that there is no process which needs to be signaled when this log
file is rotated.
U indicates that the file specified by path_to_pid_file will contain the ID
for a process group instead of a process. This option also requires that
the first line in that file be a negative value to distinguish it from a
Z indicates that newsyslog(8) should attempt to save disk space by compressing
the rotated log file using gzip(1).
- a minus sign will not cause any special processing, but it can be used as a
placeholder to create a flags field when you need to specify any of the fol-
This optional field specifies the file name containing a daemon's process ID or to
find a group process ID if the U flag was specified. If this field is present, a
signal_number is sent the process ID contained in this file. If this field is not
present, then a SIGHUP signal will be sent to syslogd(8), unless the N flag has been
specified. This field must start with '/' in order to be recognized properly.
This optional field specifies the signal number that will be sent to the daemon
process (or to all processes in a process group, if the U flag was specified). If
this field is not present, then a SIGHUP signal will be sent.
bzip2(1), gzip(1), syslog(3), chown(8), newsyslog(8), syslogd(8)
This manual page first appeared in FreeBSD 4.10.
BSD November 27, 2006 BSD