LinuxQuestions.org - enabling/disabling specific priority in syslog.conf

- Linux - Newbie (https://www.linuxquestions.org/questions/linux-newbie-8/)

- - enabling/disabling specific priority in syslog.conf (https://www.linuxquestions.org/questions/linux-newbie-8/enabling-disabling-specific-priority-in-syslog-conf-880111/)

enabling/disabling specific priority in syslog.conf

Trying to figure out why the following two are treated differently...

Code:

*.warn;\

        kern.!=debug;auth.none;\

        authpriv.none;cron.none;mail.none;news.none    -/var/log/syslog

and

Code:

*.warn;\

        authpriv.none;cron.none;mail.none;news.none;\

        kern.!=debug;auth.none;\                        -/var/log/syslog

According to man syslog.conf "You can specify multiple facilities with the same priority pattern in one statement using the comma (``,'') operator. You may specify as much facilities as you want. Remember that only the facility part from such a statement is taken, a priority part would be skipped."

Can someone confirm that this statement means that kern.!=debug is ignored in the first part because it's priority is not the same as the trailing facilities ending in .none?

No, they're 2 different things. A line from /etc/syslog.conf broken into tokens looks like :-

Code:

<selector>;<selector>;... <action>

where a <selector> is made up of

Code:

<facility.priority>  (<priority> or higher)

<facility.=priority>  (only <priority>)

<facility.!=priority> ( all priorities except <priority>)

<facility,facility,facility.priority> (as per the section you quoted)

Selectors can be overwritten by a following selector in the same line
eg.

Code:

kern.*;kern.!=debug -/var/log/messages

All message priorities except debug from the kern facility

I can't see that any of the ones you quoted will affect your 'kern.!=debug' selector.