I have to make a rule in rsyslog.conf file in order to get the mail logs which at least notice priority but with exception of err priority to a certain path.

Here is the rule I tried to make for this:

mail.notice,!err        -/var/log/usomail.log

The problem is that it logs me the errors too, and I don`t want to do that. What is wrong with my rule?


You're using comma , to separate mail.notice and !err. However, this is additive so you're saying Accept messages at mail.notice and also all !err. What you want is to say Accept messages at mail.notice except for mail.err.

The man page for rsyslog.conf does show this, although it's not as clear as it could be:

You can specify multiple facilities with the same priority pattern in one statement using the comma (',') operator. You may specify as much facilities as you want. Remember that only the facility part from such a statement is taken, a priority part would be skipped.

Multiple selectors may be specified for a single action using the semicolon (';') separator. Remember that each selector in the selector field is capable to overwrite the preceding ones. Using this behavior you can exclude some priorities from the pattern.

Therefore, the solution is to replace the comma , with a semicolon ; and include the facility thus:

mail.notice;mail.!=err  -/var/log/usomail.log

There is a similar example in the syslog.conf man page too.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.