Debian – Understanding rsyslog Config Line *.*;auth,authpriv.none -/var/log/syslog

debianrsyslog

I'm trying to understand the /etc/rsyslog.conf file, but I'm missing something. For example, this is a part of the file:

auth,authpriv.*         /var/log/auth.log
*.*;auth,authpriv.none      -/var/log/syslog
cron.*              /var/log/cron.log
daemon.*            -/var/log/daemon.log
kern.*              -/var/log/kern.log
lpr.*               -/var/log/lpr.log
mail.*              -/var/log/mail.log
user.*              -/var/log/user.log

According to this page:

The facility is one of the following keywords: auth, authpriv, cron,
daemon, kern, lpr, mail, mark, news, security (same as auth), syslog,
user, uucp and local0 through local7.

The priority is one of the following keywords, in ascending order:
debug,info, notice, warning, warn (same as warning), err, error (same
as err) crit, alert, emerg, panic (same as emerg). The keywords error,
warn and panic are deprecated and should not be used anymore. The
priority defines the severity of the message.

An asterisk ("*") stands for all facilities or all priorities,
depending on where it is used (before or after the period). The
keyword none stands for no priority of the given facility.

You can specify multiple facilities with the same priority pattern in
one statement using the comma (",") operator. You may specify as much
facilities as you want. Remember that only the facility part from such
a statement is taken, a priority part would be skipped.

Multiple selectors may be specified for a single action using the
semicolon (";") separator. Remember that each selector in the
selector field is capable to overwrite the preceding ones. Using this
behavior you can exclude some priorities from the pattern.

So, this is pretty understandable but what about the file path on the right. It can be just a path, or path with | or - before it (or maybe even something else). What is the difference between the three?

Best Answer

Given

*.*;auth,authpriv.none      -/var/log/syslog

*.* means log all facilities and all priorities.

auth,authpriv.none means don't log the auth and authpriv facilities.

-/var/log/syslog means log to the file /var/log/syslog. The preceding dash tells syslogd not to call fsync(), i.e. do not flush the kernel buffer to disk after every write to the file.

Related Question