S6-SOCKLOG(8)

💅 S6-SOCKLOG(8) — the minimal syslog daemon, but make it a group chat

okay so this is the manual page for s6-socklog, from the System Manager's Manual, and bestie you are about to understand syslog on a spiritual level. let's go 🫶

---

✨ NAME ✨

s6-socklog — a minimal syslog daemon. like, minimal minimal. it does its one job and it slays 💅

---

🌸 SYNOPSIS 🌸

s6-socklog [-d notif] [-r] [-U | -u uid -g gid -G gidlist] [-l linelen]
           [-t lameducktimeout] [-x unixsocket | -i ipport]

---

🦋 DESCRIPTION 🦋

s6-socklog is a glow-up reimplementation of the socklog(8) program, except with a few extra features. it's giving "same girl, better hair" ✨

So here's the vibe: s6-socklog reads datagrams from the /dev/log Unix domain socket — or from a Unix domain or Internet domain socket of your choice if you're feeling spicy — converts the encoded syslog facility and priority names into their human-readable equivalents, and prints the logs to its stdout. iconique.

• s6-socklog binds to /dev/log.
• It drops its root privileges. (responsible queen behavior 👑)
• For every datagram it reads, it turns its content into a log line:
  • Messages are truncated to 1024 characters.
  • Trailing nulls or newlines are removed.
  • Embedded nulls or newlines are converted to ~ characters (tildes).
  • A syslogcode at the beginning of the line is converted to facility.priority: .
• It prints the log line to its stdout, terminated by a newline.
• It exits 0 on a SIGTERM.

💀 Signals

s6-socklog reacts to the following signals:

• SIGTERM — exit as soon as possible. no drama, no goodbyes, just gone 🧚

🌈 Typical use

s6-socklog can be paired with s6-log(8) to implement syslogd functionality. think of it as a collab 🤝

s6-socklog acts as the frontend: it reads the log lines and processes them, then pipes them to an s6-log(8) instance that acts as the backend — i.e. it sorts the log lines depending on regular expressions that typically involve the facility and priority names, then stores them into the filesystem.

The pipe between s6-socklog and s6-log(8) is typically a logging pipe automatically provided by s6-svscan(8) when the s6-log(8) instance is declared as a logger service for the s6-socklog instance. so they're literally linked up by the system, it's fate 💖

The examples/ subdirectory of the s6 package contains a turnkey syslogd service that implements this pattern.

lowkey important: s6-socklog cannot be used under s6-ipcserver(8) or another super-server. It does not implement the "socklog ucspi functionality", which is provided by the ucspilogd(8) program instead. wrong tool for that job, bestie, don't do it 🙈

---

🎀 OPTIONS 🎀

• -r — raw logging. <syslogcode> codes will not be converted to facility/priority names. you get the raw unedited footage, no filter ✨
• -d notif — when ready (actually bound to its socket), write a newline to file descriptor notif then close it. this allows s6-socklog to use the s6-notifywhenup(7) mechanism to notify readiness. notif cannot be less than 3. if this option is not given, no readiness notification is sent. it's basically the "i'm here, i'm ready, i'm that girl" ping 💅
• -u uid — drop user id to uid.
• -g gid — drop group id to gid.
• -G gidlist — set supplementary group list to gidlist, which must be given as a comma-separated list of numeric gids, without spaces. no spaces, bestie, i'm serious 🫶
• -U — set user id, group id and supplementary group list to the values of the UID, GID and GIDLIST environment variables. if a -u, -g or -G option is given after -U, the command line value overrides the environment variable. later wins, periodt 👑
• -l linelen — set the maximum datagram size to linelen. default is 1024. it cannot be set to less than 80 or more than 1048576. if a datagram is bigger than linelen, it will be truncated to linelen characters, and the logged line will end with a ... ellipsis to show the truncation. the ... is the "and that's all you're getting" indicator 😭
• -t lameducktimeout — on receipt of a SIGTERM, give s6-socklog a grace period of lameducktimeout milliseconds to flush any log lines that are still in its buffer. default is 0, which means infinite — the program will only exit when its buffer is empty, and may wait forever. if lameducktimeout is nonzero and the timeout expires, the program will exit 99. the "i need a minute" option, but sometimes the minute never comes 💀
• -x unixsocket — bind to a Unix domain socket at unixsocket. default is /dev/log.
• -i ipport — bind to a UDP socket. ipport is a combination of ip, which must be an IPv4 or IPv6 address, and port, which must be an integer. port may be omitted, in which case it defaults to 514. if port is given, ip and port must be separated by a _ character (an underscore). if ip is IPv4, a : (colon) can be used instead of an underscore. when this option is used, s6-socklog will prepend every log line with clientip_clientport: , clientip and clientport being the IP address and port of the client that sent the log datagram. caller ID but for syslog, iconic 🔥

---

🔥 EXIT STATUS 🔥

• 0 — SIGTERM received, clean exit. the graceful goodbye 🌸
• 99 — SIGTERM received but the buffer could not be flushed in time, some logs may be lost. tragedy, honestly 😭
• 100 — wrong usage. you did it wrong bestie, it's giving user error.
• 111 — system call failed. the OS said no. rude. 💀

---

💜 SEE ALSO 💜

s6-ipcserver(8), s6-log(8), s6-svscan(8), socklog(8), ucspilogd(8)

This man page is ported from the authoritative documentation at: https://skarnet.org/software/s6/s6-socklog.html

---

⭐ AUTHORS ⭐

Laurent Bercot Alexis <flexibeast@gmail.com> (man page port)

---

okay that's the whole thing, and before you go — huge shoutout to the Debian crew, this one's dated September 29, 2021, and it shipped as part of the System Manager's Manual on Debian. go forth and log responsibly 🎀✨