metalog.conf(5) Metalog configuration file metalog.conf(5)NAMEmetalog.conf - configuration file for metalog
SYNTAX
[default values]
<section title :>
<section values>
<section 2 title :>
<section 2 values>
<etc.>
DESCRIPTION
[default values] will be used if you do not redefine them in a section.
You can choose <section title> as you wish. It doesn't mean anything,
just allow you to keep an easy to read config file.
Values names can be one of the following:
maxsize
maxsize = <value>. Once a logfile has exceeded the value defined
(in bytes), it will be rotated. If maxfile is equal to zero, it
disables log rotation. Defining a default value is a good idea.
maxtime
maxtime = <value>. Once a logfile is older than the value
defined (in seconds), it will be rotated. Defining a default
value is a good idea.
NB: a logfile is rotated when either maxsize or maxtime limit is
reached. If either one or both is equal 0, then log rotation is
disabled.
maxfiles
maxfiles = <value>. This value indicates the maximum number of
rotated files kept. So you'll have x rotated files (log-date-
string filename type), plus the file named current.
facility
facility = "name". Only records a message if the application
that issued it uses syslog facility <facility>. Facility names
are : "auth", "authpriv", "cron", "daemon", "ftp", "kern",
"lpr", "mail", "news", "security", "syslog", "user", "uucp",
"local0", "local1" ... "local7" . All kernel messages are logged
with facility "kern". A section can have several "facility =
..." lines to match more than one facility. If <facility> is
"*", it'll match all the facilities.
break break = <value>. Default is 0. If set to 1 and a section is
matched, perform action, but don't consider any more possible
section matches below this one in the config file. This is use‐
ful for creating a config where specific types of log messages
are matched and dispatched, while a "catch-all" section at the
bottom of the config file handles the default case. Using
break=0 would cause messages to be potentially handled by multi‐
ple sections, causing message duplication, while using break = 1
on the sections above the "catch-all" would avoid duplication.
minimum
minimum = <level> : Only record a message if its urgency is
inferior or equal to <level> . Level '0' is the most critical
one, while level '7' is for debugging messages. 'minimum = 5'
will strip all non-important messages. The default minimum level
is 7 (ie. keep all messages).
maximum
maximum = <level> : don't log if the message level exceeds that
value. By default, maximum is the largest possible level.
logdir logdir = "/path/where/logs/will/be/written" : files will be
written in /path/where/logs/will/be/written.
program
program = "name". Can be used when a facility is useless. Remem‐
ber to use the executable name.
regex regex = "perl compatible regular expression". Can be used when
you want to log given patterns, like invalid, fail etc to get in
a given directory everything that failed or was invalid. Several
regex can be defined in a section.
neg_regex
neg_regex = "perl compatible regular expression". Can be used
when you want to log the opposite of given patterns. Several
neg_regex can be defined in a section.
postrotate_cmd
postrotate_cmd = "/path/to/a/program". Run specified program
after a log file has been rotated. The program is passed the
date, the program name ("metalog"), and the new logfile name.
program_regex
program_regex = "perl compatible regular expression". Can be
used when you have, for example a familly of programs having the
same pattern in their names, and you want to get logs central‐
ized in a given path.
program_neg_regex
program_neg_regex = "perl compatible regular expression". Can be
used when you want to log programs which do not match a pattern
in their names. Several program_neg_regex can be defined in a
section.
showrepeats
showrepeats = <value>. Set to 0 to filter out repeat log mes‐
sages.
command
command = "/path/to/program/to/execute". If something is logged
in a given section, you can automatically launch a program. The
log message is passed as the arguments to the program. The
argv[1] is the date, argv[2] is the program, and argv[3] is the
actual log message.
stamp_fmt
stamp_fmt = "%b %e %T". Format of the human readable timestamp
prepended to all log messages. This format string is passed lit‐
erally to the strftime(3) function. An empty string is used to
disable timestamping (for cases where the logger already does
its own timestamping).
flush flush = <value>. If set to 0, matching log messages will always
be buffered. If set to 1, they will always be written to the
file system immediately. Both settings override the global
default given through command line parameters (-a/-s) or sig‐
nals.
ratelimit
ratelimit = "5/m". Limits the rate of logged messages to the
specified number of messages per unit of time. Valid units of
time are second, minute, hour and day, each identified by its
first letter. Fractional values are allowed such as "0.5/m" to
make human parsing easier. A limit of zero (the default) may be
used to disable any rate limit handling. In this case, the unit
of time may be omitted.
ratelimit_burst
ratelimit_burst = <integer>. Up to this number of lines will be
printed at the beginning of a burst of message, if the rate of
messages has been well below the limit before. The specified
message rate will not be exceeded. The default value of 1 dis‐
ables special treatment for bursts. Values less than 1 are
invalid and will be rejected.
FILES
Note that the exact paths depend on the build settings. These are the
standard paths.
/usr/local/etc/metalog.conf
AUTHORS
Mike Frysinger <vapier@gentoo.org>
Laurent Wandrebeck (low) <wandre.l@free.fr>
Leo Lipelis <aeoo@gentoo.org>
Hendrik Visage <hvisage@users.sourceforge.net>
Frank DENIS (Jedi/Sector One) <j@pureftpd.org>
SEE ALSOmetalog(8)Frank DENIS 3 metalog.conf(5)
