I'm trying to understand the
/etc/rsyslog.conf file, but I'm missing something. For example, this is a part of the file:
auth,authpriv.* /var/log/auth.log *.*;auth,authpriv.none -/var/log/syslog cron.* /var/log/cron.log daemon.* -/var/log/daemon.log kern.* -/var/log/kern.log lpr.* -/var/log/lpr.log mail.* -/var/log/mail.log user.* -/var/log/user.log
According to this page:
The facility is one of the following keywords: auth, authpriv, cron, daemon, kern, lpr, mail, mark, news, security (same as auth), syslog, user, uucp and local0 through local7.
The priority is one of the following keywords, in ascending order: debug,info, notice, warning, warn (same as warning), err, error (same as err) crit, alert, emerg, panic (same as emerg). The keywords error, warn and panic are deprecated and should not be used anymore. The priority defines the severity of the message.
An asterisk ("*") stands for all facilities or all priorities, depending on where it is used (before or after the period). The keyword none stands for no priority of the given facility.
You can specify multiple facilities with the same priority pattern in one statement using the comma (",") operator. You may specify as much facilities as you want. Remember that only the facility part from such a statement is taken, a priority part would be skipped.
Multiple selectors may be specified for a single action using the semicolon (";") separator. Remember that each selector in the selector field is capable to overwrite the preceding ones. Using this behavior you can exclude some priorities from the pattern.
So, this is pretty understandable but what about the file path on the right. It can be just a path, or path with
- before it (or maybe even something else). What is the difference between the three?