You're using comma
, to separate
!err. However, this is additive so you're saying Accept messages at
mail.notice and also all
!err. What you want is to say Accept messages at
mail.notice except for
The man page for
rsyslog.conf does show this, although it's not as clear as it could be:
You can specify multiple facilities with the same priority pattern in one statement using the comma (',') operator. You may specify as much facilities as you want. Remember that only the facility part from such a statement is taken, a priority part would be skipped.
Multiple selectors may be specified for a single action using the semicolon (';') separator. Remember that each selector in the selector field is capable to overwrite the preceding ones. Using this behavior you can exclude some priorities from the pattern.
Therefore, the solution is to replace the comma
, with a semicolon
; and include the facility thus:
There is a similar example in the
syslog.conf man page too.