syslog-ng - syslog-ng system logger application
NOTE: This manual page covers both editions of syslog-ng: syslog-ng
Open Source Edition and the commercial syslog-ng Premium Edition.
Features that are only included in the Premium Edition are marked with
an asterisk (*). For details, see the official syslog-ng website:
This manual page is only an abstract; for the complete documentation of
The syslog-ng Administrator Guide .
The syslog-ng application is a flexible and highly scalable system
logging application. Typically, syslog-ng is used to manage log
messages and implement centralized logging, where the aim is to collect
the log messages of several devices on a single, central log server.
The different devices - called syslog-ng clients - all run syslog-ng,
and collect the log messages from the various applications, files, and
other sources. The clients send all important log messages to the
remote syslog-ng server, where the server sorts and stores them.
--cfgfile <file> or -f <file>
Use the specified configuration file.
--chroot <dir> or -C <dir>
Change root to the specified directory after reading the
configuration file. The directory must be set up accordingly. Note
that it is not possible to reload the syslog-ng configuration after
--debug or -d
Start syslog-ng in debug mode.
Enable syslog-ng to write core files in case of a crash to help
support and debugging.
Set the minimal number of required file descriptors (fd-s); this
sets how many files syslog-ng can keep open simultaneously. Default
value: 4096. Note that this does not override the global ulimit
setting of the host.
--foreground or -F
Do not daemonize, run in the foreground.
--group <group> or -g <group>
Switch to the specified group after initializing the configuration
--help or -h
Display a brief help message.
Run syslog-ng as root, without capability-support. This is the
default behavior. On Linux, it is possible to run syslog-ng as
non-root with capability-support if syslog-ng was compiled with the
--enable-linux-caps option enabled. (Execute syslog-ng --version to
display the list of enabled build parameters.)
--persist-file <persist-file> or -R <persist-file>
Set the path and name of the syslog-ng.persist file where the
persistent options and data are stored.
--pidfile <pidfile> or -p <pidfile>
Set path to the PID file where the pid of the main process is
Sets how to run syslog-ng: in the foreground (mainly used for
debugging), in the background as a daemon, or in safe-background
mode, when syslog-ng restarts itself if it crashes. By default,
syslog-ng runs in safe-background mode.
--qdisk-dir <path> or -Q <path>
Specify the location of the file used for disk-based buffering. By
default, this file is located at /var/lib/syslog-ng/.
--stderr or -e
Log internal messages of syslog-ng to stderr. Mainly used for
debugging purposes in conjunction with the --foreground option.
--syntax-only or -s
Verify that the configuration file is syntactically correct and
--user <user> or -u <user>
Switch to the specified user after initializing the configuration
file (and optionally chrooting). Note that it is not possible to
reload the syslog-ng configuration if the specified user has no
privilege to create the /dev/log file.
--verbose or -v
Enable verbose logging used to troubleshoot syslog-ng.
--version or -V
Display version number and compilation information.
The syslog-ng Administrator Guide 
If you experience any problems or need help with syslog-ng, visit the
syslog-ng mailing list 
For news and notifications about the documentation of syslog-ng, visit
the BalaBit Documentation Blog.
This manual page was written by the BalaBit Documentation Team
Copyright (C) 2000-2009 BalaBit IT Security Ltd. Published under the
Creative Commons Attribution-Noncommercial-No Derivative Works
(by-nc-nd) 3.0 license. See http://creativecommons.org/ for details.
The latest version is always available at
The syslog-ng Administrator Guide
syslog-ng mailing list
3. BalaBit Documentation Blog