Sys::Syslog(3pm)

📦
version 5.42.3 · 9 versions
, in alpine 3.24

💜 Sys::Syslog(3pm) — Perl Programmers Reference Guide, bestie edition 🦋

okay so this is the Sys::Syslog page from the Perl Programmers Reference Guide and honestly? she's iconic. it's giving "Unix but make it Perl." buckle up 🎀

✨ NAME ✨

Sys::Syslog — the Perl interface to the UNIX syslog(3) calls. yes. that's the whole vibe. 💅

🌸 VERSION 🌸

This is the documentation of version 0.36. no cap, that's the number, don't @ me.

🦋 SYNOPSIS 🦋

here's the group chat, laid out for u:

use Sys::Syslog;                        # all except setlogsock()
use Sys::Syslog qw(:standard :macros);  # standard functions & macros

openlog($ident, $logopt, $facility);    # don't forget this
syslog($priority, $format, @args);
$oldmask = setlogmask($mask_priority);
closelog();

like, do not forget openlog. the comment literally says so, and the comments never lie. 😌

⭐ DESCRIPTION ⭐

Sys::Syslog is an interface to the UNIX syslog(3) program. that's it, that's the girl.

you call syslog() with a string priority and a list of printf() args, exactly like you would with syslog(3). same energy, more Perl. 🫶

💖 EXPORTS 💖

Sys::Syslog exports the following Exporter tags:

  • :standard — exports the standard syslog(3) functions:
openlog closelog setlogmask syslog
  • :extended — exports the Perl specific functions for syslog(3):
setlogsock
  • :macros — exports the symbols corresponding to most of your syslog(3) macros, plus the LOG_UPTO() and LOG_MASK() functions. peep CONSTANTS for the supported constants and what they actually mean.

and by default, Sys::Syslog exports the symbols from the :standard tag. so chill, u get the classics automatically. ✨

👑 FUNCTIONS 👑

🌈 openlog($ident, $logopt, $facility)

opens the syslog, bestie. let's break the args down:

  • $ident gets prepended to every message. every single one. it's her signature 💅
  • $logopt holds zero or more of the options detailed below (yes, zero is allowed, live ur life)
  • $facility specifies the part of the system to report about — for example "LOG_USER" or "LOG_LOCAL0". see "Facilities" for a list of well-known facilities, and check your syslog(3) documentation for the facilities your system actually has. also check "SEE ALSO" for useful links. facility can be given as a string or a numeric macro, ur choice 🎀

this function will croak if it can't connect to the syslog daemon. not a vibe check u wanna fail, ngl.

note that openlog() now takes three arguments, just like openlog(3). glow up. 😌

and please — you should use openlog() before calling syslog(). it's not a suggestion, it's a lifestyle.

🍓 Options

  • "cons" — this option is ignored, since the failover mechanism will drop down to the console automatically if all other media fail. so like... she's already got ur back.
  • "ndelay" — open the connection immediately (normally, the connection is opened when the first message is logged).
  • "noeol" — when set to true, no end of line character ("\n") will be appended to the message. can be useful for some syslog daemons. added in Sys::Syslog 0.29.
  • "nofatal" — when set to true, openlog() and syslog() will only emit warnings instead of dying if the connection to the syslog can't be established. added in Sys::Syslog 0.15. soft launch failure, love that for us.
  • "nonul" — when set to true, no "NUL" character ("\0") will be appended to the message. can be useful for some syslog daemons. added in Sys::Syslog 0.29.
  • "nowait" — don't wait for child processes that may have been created while logging the message. (the GNU C library does not create a child process, so this option has no effect on Linux.) okay Linux girlies, this one's a no-op for u 💀
  • "perror" — write the message to standard error output as well to the system log. added in Sys::Syslog 0.22.
  • "pid" — include PID with each message. receipts! 🧾

🧚 Examples

open the syslog with options "ndelay" and "pid", and with facility "LOCAL0":

openlog($name, "ndelay,pid", "local0");

same thing, but this time using the macro corresponding to "LOCAL0":

openlog($name, "ndelay,pid", LOG_LOCAL0);

🌸 syslog($priority, $message)

🌸 syslog($priority, $format, @args)

if $priority permits, logs $message or sprintf($format, @args) — with the little bonus that %m in $message or $format gets replaced with "$!" (the latest error message). cute AND useful.

$priority can specify a level, or a level and a facility. levels and facilities can be given as strings or as macros. when using the "eventlog" mechanism, priorities "DEBUG" and "INFO" are mapped to event type "informational", "NOTICE" and "WARNING" to "warning", and "ERR" to "EMERG" to "error". mapping is mapping, she's doing her best 🫶

if you didn't use openlog() before using syslog(), syslog() will try to guess the $ident by extracting the shortest prefix of $format that ends in a ":". detective mode activated 🔍

🎀 Examples

# informational level
syslog("info", $message);
syslog(LOG_INFO, $message);

# information level, Local0 facility
syslog("info|local0", $message);
syslog(LOG_INFO|LOG_LOCAL0, $message);

💀 Note

Sys::Syslog version v0.07 and older passed the $message as the formatting string to sprintf() even when no formatting arguments were provided. so if the code calling syslog() might execute with older versions of this module, make sure to call the function as syslog($priority, "%s", $message) instead of syslog($priority, $message). this protects against hostile formatting sequences that might show up if $message contains tainted data. protecting ur code from the haters, periodt. 🛡️

🦋 setlogmask($mask_priority)

sets the log mask for the current process to $mask_priority and returns the old mask. if the mask argument is 0, the current log mask is not modified (she said leave it, so leave it). see "Levels" for the list of available levels. you can use the LOG_UPTO() function to allow all levels up to a given priority — but heads up, it only accepts the numeric macros as arguments. 🙈

💅 Examples

only log errors:

setlogmask( LOG_MASK(LOG_ERR) );

log everything except informational messages:

setlogmask( ~(LOG_MASK(LOG_INFO)) );

log critical messages, errors and warnings:

setlogmask( LOG_MASK(LOG_CRIT)
          | LOG_MASK(LOG_ERR)
          | LOG_MASK(LOG_WARNING) );

log all messages up to debug:

setlogmask( LOG_UPTO(LOG_DEBUG) );

⭐ setlogsock()

sets the socket type and options to be used for the next call to openlog() or syslog(). returns true on success, undef on failure. no in-between, she's not complicated. 😌

being Perl-specific, this function has evolved along time. it can currently be called as follow:

  • setlogsock($sock_type)
  • setlogsock($sock_type, $stream_location) (added in Perl 5.004_02)
  • setlogsock($sock_type, $stream_location, $sock_timeout) (added in Sys::Syslog 0.25)
  • setlogsock(\%options) (added in Sys::Syslog 0.28)

the available options are:

  • "type" — equivalent to $sock_type, selects the socket type (or "mechanism"). an array reference can be passed to specify several mechanisms to try, in the given order. ~options~
  • "path" — equivalent to $stream_location, sets the stream location. defaults to standard Unix location, or "_PATH_LOG".
  • "timeout" — equivalent to $sock_timeout, sets the socket timeout in seconds. defaults to 0 on all systems except Mac OS X where it is set to 0.25 sec. Mac girlies stay patient 🍎
  • "host" — sets the hostname to send the messages to. defaults to the local host.
  • "port" — sets the TCP or UDP port to connect to. defaults to the first standard syslog port available on the system.

the available mechanisms are:

  • "native" — use the native C functions from your syslog(3) library (added in Sys::Syslog 0.15).
  • "eventlog" — send messages to the Win32 events logger (Win32 only; added in Sys::Syslog 0.19).
  • "tcp" — connect to a TCP socket, on the "syslog/tcp" or "syslogng/tcp" service. see also the "host", "port" and "timeout" options.
  • "udp" — connect to a UDP socket, on the "syslog/udp" service. see also the "host", "port" and "timeout" options.
  • "inet" — connect to an INET socket, either TCP or UDP, tried in that order. see also the "host", "port" and "timeout" options.
  • "unix" — connect to a UNIX domain socket (in some systems a character special device). the name of that socket is given by the "path" option or, if omitted, the value returned by the "_PATH_LOG" macro (if your system defines it), /dev/log or /dev/conslog, whichever is writable.
  • "stream" — connect to the stream indicated by the "path" option, or, if omitted, the value returned by the "_PATH_LOG" macro (if your system defines it), /dev/log or /dev/conslog, whichever is writable. for example Solaris and IRIX system may prefer "stream" instead of "unix".
  • "pipe" — connect to the named pipe indicated by the "path" option, or, if omitted, to the value returned by the "_PATH_LOG" macro (if your system defines it), or /dev/log (added in Sys::Syslog 0.21). HP-UX is a system which uses such a named pipe.
  • "console" — send messages directly to the console, as for the "cons" option of openlog().

the default is to try "native", "tcp", "udp", "unix", "pipe", "stream", "console". under systems with the Win32 API, "eventlog" will be added as the first mechanism to try if Win32::EventLog is available. she's thorough like that. 💅

giving an invalid value for $sock_type will croak. croak, bestie. do not test her.

🧚 Examples

select the UDP socket mechanism:

setlogsock("udp");

send messages using the TCP socket mechanism on a custom port:

setlogsock({ type => "tcp", port => 2486 });

send messages to a remote host using the TCP socket mechanism:

setlogsock({ type => "tcp", host => $loghost });

try the native, UDP socket then UNIX domain socket mechanisms:

setlogsock(["native", "udp", "unix"]);

🙈 Note

now that the "native" mechanism is supported by Sys::Syslog and selected by default, the use of the setlogsock() function is discouraged because other mechanisms are less portable across operating systems. authors of modules and programs that use this function, especially its cargo-cult form setlogsock("unix"), are advised to remove any occurrence of it unless they specifically want to use a given mechanism (like TCP or UDP to connect to a remote host). so like... stop copy-pasting setlogsock("unix") from that one Stack Overflow thread from 2009. i'm begging. 😭

🎀 closelog()

closes the log file and returns true on success. short, sweet, clean exit. she ate and left no crumbs. ✨

💅 THE RULES OF SYS::SYSLOG 💅

okay bestie, it’s fight-club energy but make it logging. no cap:

The First Rule of Sys::Syslog is: You do not call setlogsock.

The Second Rule of Sys::Syslog is: You do not call setlogsock.

The Third Rule of Sys::Syslog is: The program crashes, "die"s, calls "closelog", the log is over.

The Fourth Rule of Sys::Syslog is: One facility, one priority.

The Fifth Rule of Sys::Syslog is: One log at a time.

The Sixth Rule of Sys::Syslog is: No syslog before openlog.

The Seventh Rule of Sys::Syslog is: Logs will go on as long as they have to.

The Eighth, and Final Rule of Sys::Syslog is: If this is your first use of Sys::Syslog, you must read the doc.

✨ EXAMPLES ✨

An example, bestie — copy it exactly, no edits:

openlog($program, 'cons,pid', 'user');
syslog('info', '%s', 'this is another test');
syslog('mail|warning', 'this is a better test: %d', time);
closelog();

syslog('debug', 'this is the last test');

Another example, because we love options:

openlog("$program $$", 'ndelay', 'user');
syslog('notice', 'fooprogram: this is really done');

Example of use of %m — the way that $! gets its moment:

$! = 55;
syslog('info', 'problem was %m');   # %m == $! in syslog(3)

Log to UDP port on $remotehost instead of logging locally:

setlogsock("udp", $remotehost);
openlog($program, 'ndelay', 'user');
syslog('info', 'something happened over here');

🎀 CONSTANTS 🎀

Facilities

  • LOG_AUDIT — audit daemon (IRIX); falls back to LOG_AUTH
  • LOG_AUTH — security/authorization messages
  • LOG_AUTHPRIV — security/authorization messages (private)
  • LOG_CONSOLE — /dev/console output (FreeBSD); falls back to LOG_USER
  • LOG_CRON — clock daemons (cron and at)
  • LOG_DAEMON — system daemons without separate facility value
  • LOG_FTP — FTP daemon
  • LOG_KERN — kernel messages
  • LOG_INSTALL — installer subsystem (Mac OS X); falls back to LOG_USER
  • LOG_LAUNCHD — launchd - general bootstrap daemon (Mac OS X); falls back to LOG_DAEMON
  • LOG_LFMT — logalert facility; falls back to LOG_USER
  • LOG_LOCAL0 through LOG_LOCAL7 — reserved for local use
  • LOG_LPR — line printer subsystem
  • LOG_MAIL — mail subsystem
  • LOG_NETINFO — NetInfo subsystem (Mac OS X); falls back to LOG_DAEMON
  • LOG_NEWS — USENET news subsystem
  • LOG_NTP — NTP subsystem (FreeBSD, NetBSD); falls back to LOG_DAEMON
  • LOG_RAS — Remote Access Service (VPN / PPP) (Mac OS X); falls back to LOG_AUTH
  • LOG_REMOTEAUTH — remote authentication/authorization (Mac OS X); falls back to LOG_AUTH
  • LOG_SECURITY — security subsystems (firewalling, etc.) (FreeBSD); falls back to LOG_AUTH
  • LOG_SYSLOG — messages generated internally by syslogd
  • LOG_USER (default) — generic user-level messages
  • LOG_UUCP — UUCP subsystem

Levels

  • LOG_EMERG — system is unusable
  • LOG_ALERT — action must be taken immediately
  • LOG_CRIT — critical conditions
  • LOG_ERR — error conditions
  • LOG_WARNING — warning conditions
  • LOG_NOTICE — normal, but significant, condition
  • LOG_INFO — informational message
  • LOG_DEBUG — debug-level message

🚨 DIAGNOSTICS 🚨

  • "Invalid argument passed to setlogsock" — (F) You gave setlogsock() an invalid value for $sock_type.
  • "eventlog passed to setlogsock, but no Win32 API available" — (W) You asked setlogsock() to use the Win32 event logger but the operating system running the program isn't Win32 or does not provides Win32 compatible facilities.
  • "no connection to syslog available" — (F) syslog() failed to connect to the specified socket.
  • "stream passed to setlogsock, but %s is not writable" — (W) You asked setlogsock() to use a stream socket, but the given path is not writable.
  • "stream passed to setlogsock, but could not find any device" — (W) You asked setlogsock() to use a stream socket, but didn't provide a path, and Sys::Syslog was unable to find an appropriate one.
  • "tcp passed to setlogsock, but tcp service unavailable" — (W) You asked setlogsock() to use a TCP socket, but the service is not available on the system.
  • "syslog: expecting argument %s" — (F) You forgot to give syslog() the indicated argument.
  • "syslog: invalid level/facility: %s" — (F) You specified an invalid level or facility.
  • "syslog: too many levels given: %s" — (F) You specified too many levels.
  • "syslog: too many facilities given: %s" — (F) You specified too many facilities.
  • "syslog: level must be given" — (F) You forgot to specify a level.
  • "udp passed to setlogsock, but udp service unavailable" — (W) You asked setlogsock() to use a UDP socket, but the service is not available on the system.
  • "unix passed to setlogsock, but path not available" — (W) You asked setlogsock() to use a UNIX socket, but Sys::Syslog was unable to find an appropriate an appropriate device.

🌸 HISTORY 🌸

Sys::Syslog is a core module, part of the standard Perl distribution since 1990. At this time, modules as we know them didn't exist, the Perl library was a collection of .pl files, and the one for sending syslog messages with was simply lib/syslog.pl, included with Perl 3.0. It was converted as a module with Perl 5.0, but had a version number only starting with Perl 5.6. Here is the matching Sys::Syslog ↔ Perl version lore:

  • undef — Perl 5.0.0 ~ 5.5.4
  • 0.01 — Perl 5.6.*
  • 0.03 — Perl 5.8.0
  • 0.04 — Perl 5.8.1, 5.8.2, 5.8.3
  • 0.05 — Perl 5.8.4, 5.8.5, 5.8.6
  • 0.06 — Perl 5.8.7
  • 0.13 — Perl 5.8.8
  • 0.22 — Perl 5.10.0
  • 0.27 — Perl 5.8.9, 5.10.1 ~ 5.14.*
  • 0.29 — Perl 5.16.*
  • 0.32 — Perl 5.18.*
  • 0.33 — Perl 5.20.*
  • 0.33 — Perl 5.22.*

🌈 SEE ALSO 🌈

Other modules

  • Log::Log4perl - Perl implementation of the Log4j API
  • Log::Dispatch - Dispatches messages to one or more outputs
  • Log::Report - Report a problem, with exceptions and language support

Manual Pages

RFCs

Articles

Event Log

🫶 AUTHORS & ACKNOWLEDGEMENTS 🫶

the literal icons who made this happen:

  • Tom Christiansen <tchrist (at) perl.com> and Larry Wall <larry (at) wall.org>.
  • UNIX domain sockets added by Sean Robinson <robinson_s (at) sc.maricopa.edu> with support from Tim Bunce <Tim.Bunce (at) ig.co.uk> and the perl5-porters mailing list.
  • Dependency on syslog.ph replaced with XS code by Tom Hughes <tom (at) compton.nu>.
  • Code for constant()s regenerated by Nicholas Clark <nick (at) ccl4.org>.
  • Failover to different communication modes by Nick Williams <Nick.Williams (at) morganstanley.com>.
  • Extracted from core distribution for publishing on the CPAN by Sébastien Aperghis-Tramoni <sebastien (at) aperghis.net>.
  • XS code for using native C functions borrowed from Unix::Syslog, written by Marcus Harnisch <marcus.harnisch (at) gmx.net>.
  • Yves Orton suggested and helped for making Sys::Syslog use the native event logger under Win32 systems.
  • Jerry D. Hedden and Reini Urban provided greatly appreciated help to debug and polish Sys::Syslog under Cygwin.

🐛 BUGS 🐛

Please report any bugs or feature requests to bug-sys-syslog (at) rt.cpan.org, or through the web interface at http://rt.cpan.org/Public/Dist/Display.html?Name=Sys-Syslog. I will be notified, and then you'll automatically be notified of progress on your bug as I make changes.

🦋 SUPPORT 🦋

You can find documentation for this module with the perldoc command.

perldoc Sys::Syslog

You can also look for information at:

The source code is available on Git Hub: https://github.com/maddingue/Sys-Syslog/

Copyright (C) 1990-2012 by Larry Wall and others.

💜 LICENSE 💜

This program is free software; you can redistribute it and/or modify it under the same terms as Perl itself.

💅 that’s a wrap, bestie — this gem is Sys::Syslog(3pm), rocking perl v5.42.3, dated 2026-11-03. mwah, go log something iconic 💖

📦 where this page comes from