14

I'm trying to understand the /etc/rsyslog.conf file, but I'm missing something. For example, this is a part of the file:

auth,authpriv.*         /var/log/auth.log
*.*;auth,authpriv.none      -/var/log/syslog
cron.*              /var/log/cron.log
daemon.*            -/var/log/daemon.log
kern.*              -/var/log/kern.log
lpr.*               -/var/log/lpr.log
mail.*              -/var/log/mail.log
user.*              -/var/log/user.log

According to this page:

The facility is one of the following keywords: auth, authpriv, cron, daemon, kern, lpr, mail, mark, news, security (same as auth), syslog, user, uucp and local0 through local7.

The priority is one of the following keywords, in ascending order: debug,info, notice, warning, warn (same as warning), err, error (same as err) crit, alert, emerg, panic (same as emerg). The keywords error, warn and panic are deprecated and should not be used anymore. The priority defines the severity of the message.

An asterisk ("*") stands for all facilities or all priorities, depending on where it is used (before or after the period). The keyword none stands for no priority of the given facility.

You can specify multiple facilities with the same priority pattern in one statement using the comma (",") operator. You may specify as much facilities as you want. Remember that only the facility part from such a statement is taken, a priority part would be skipped.

Multiple selectors may be specified for a single action using the semicolon (";") separator. Remember that each selector in the selector field is capable to overwrite the preceding ones. Using this behavior you can exclude some priorities from the pattern.

So, this is pretty understandable but what about the file path on the right. It can be just a path, or path with | or - before it (or maybe even something else). What is the difference between the three?

Improve this question

1 Answer 1

Reset to default
19

Given

*.*;auth,authpriv.none      -/var/log/syslog

*.* means log all facilities and all priorities.

auth,authpriv.none means don't log the auth and authpriv facilities.

-/var/log/syslog means log to the file /var/log/syslog. The preceding dash tells syslogd not to call fsync(), i.e. do not flush the kernel buffer to disk after every write to the file.

Improve this answer
5
  • How does auth,authpriv.none mean don't log? From the quoted doc, "each selector in the selector field is capable to overwrite the preceding ones" - where is the detail of that behaviour documented? I would have expected the auth part to match the auth facility that had already been matched under *.*, rather than disabling it.
    – jl6
    May 13, 2014 at 20:29
  • 2
    auth,authpriv matches both auth and authpriv. The .none part applies to both of them. *.*;auth;authpriv.none would behave as you describe.
    – Kyle Jones
    May 14, 2014 at 2:19
  • OK thanks! And is that documented anywhere?
    – jl6
    May 14, 2014 at 6:02
  • 1
    It's implied in the documentation above. The priority part is skipped (ignored) for all but the last facility if you list multiple facilities using a comma. The docs could certainly be improved in this area.
    – Kyle Jones
    May 14, 2014 at 19:42
  • I added the line *.*;auth,authpriv.none /dev/console so that the syslog messages also come out on the console (tty1) on my Raspberry Pi. I have a monitor plugged into my Pi server that is used just to monitor the logs. I ssh in to do any work on it you see.
    – Will
    May 26, 2019 at 8:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.