NOTE: This manual page covers both editions of syslog-ng: syslog-ng Open Source Edition and the commercial syslog-ng Premium Edition. Features that are only included in the Premium Edition are marked with an asterisk (*). For details, see the official syslog-ng website:
This manual page is only an abstract; for the complete documentation of syslog-ng, see
The syslog-ng Administrator Guide .
The syslog-ng application is a flexible and highly scalable system logging application. Typically, syslog-ng is used to manage log messages and implement centralized logging, where the aim is to collect the log messages of several devices on a single, central log server. The different devices - called syslog-ng clients - all run syslog-ng, and collect the log messages from the various applications, files, and other
sources. The clients send all important log messages to the remote syslog-ng server, where the server sorts and stores them.
--cfgfile <file> or -f <file>
Use the specified configuration file.
--chroot <dir> or -C <dir>
Change root to the specified directory after reading the configuration file. The directory must be set up accordingly. Note that it is not possible to reload the syslog-ng configuration after chrooting.
--debug or -d
Start syslog-ng in debug mode.
Enable syslog-ng to write core files in case of a crash to help support and debugging.
Set the minimal number of required file descriptors (fd-s); this sets how many files syslog-ng can keep open simultaneously. Default value:
4096. Note that this does not override the global ulimit setting of the host.
--foreground or -F
Do not daemonize, run in the foreground.
--group <group> or -g <group>
Switch to the specified group after initializing the configuration file.
--help or -h
Display a brief help message.
Run syslog-ng as root, without capability-support. This is the default behavior. On Linux, it is possible to run syslog-ng as non-root with capability-support if syslog-ng was compiled with the
option enabled. (Execute
to display the list of enabled build parameters.)
--persist-file <persist-file> or -R <persist-file>
Set the path and name of the
file where the persistent options and data are stored.
--pidfile <pidfile> or -p <pidfile>
Set path to the PID file where the pid of the main process is stored.
Sets how to run syslog-ng: in the
(mainly used for debugging), in the
as a daemon, or in
mode, when syslog-ng restarts itself if it crashes. By default, syslog-ng runs in
--qdisk-dir <path> or -Q <path>
Specify the location of the file used for disk-based buffering. By default, this file is located at
--stderr or -e
Log internal messages of syslog-ng to stderr. Mainly used for debugging purposes in conjunction with the
--syntax-only or -s
Verify that the configuration file is syntactically correct and exit.
--user <user> or -u <user>
Switch to the specified user after initializing the configuration file (and optionally chrooting). Note that it is not possible to reload the syslog-ng configuration if the specified user has no privilege to create the
--verbose or -v
Enable verbose logging used to troubleshoot syslog-ng.
--version or -V
Display version number and compilation information.
The syslog-ng Administrator Guide 
If you experience any problems or need help with syslog-ng, visit the
syslog-ng mailing list 
For news and notifications about the documentation of syslog-ng, visit the
BalaBit Documentation Blog.
This manual page was written by the BalaBit Documentation Team <firstname.lastname@example.org>.
Copyright © 2000-2009 BalaBit IT Security Ltd. Published under the Creative Commons Attribution-Noncommercial-No Derivative Works (by-nc-nd) 3.0 license. See
for details. The latest version is always available at
The syslog-ng Administrator Guide
syslog-ng mailing list
BalaBit Documentation Blog
- SEE ALSO
This document was created by
using the manual pages.
Time: 22:02:28 GMT, April 16, 2011