enabling/disabling specific priority in syslog.conf

dimm0k · 05-11-2011, 10:51 AM

Trying to figure out why the following two are treated differently...

Code:

*.warn;\
        kern.!=debug;auth.none;\
        authpriv.none;cron.none;mail.none;news.none     -/var/log/syslog

and

Code:

*.warn;\
        authpriv.none;cron.none;mail.none;news.none;\
        kern.!=debug;auth.none;\                        -/var/log/syslog

According to man syslog.conf "You can specify multiple facilities with the same priority pattern in one statement using the comma (``,'') operator. You may specify as much facilities as you want. Remember that only the facility part from such a statement is taken, a priority part would be skipped."

Can someone confirm that this statement means that kern.!=debug is ignored in the first part because it's priority is not the same as the trailing facilities ending in .none?

kbp · 05-24-2011, 01:36 AM

No, they're 2 different things. A line from /etc/syslog.conf broken into tokens looks like :-

Code:

<selector>;<selector>;... <action>

where a <selector> is made up of

Code:

<facility.priority>   (<priority> or higher)
<facility.=priority>  (only <priority>)
<facility.!=priority> ( all priorities except <priority>)
<facility,facility,facility.priority> (as per the section you quoted)

Selectors can be overwritten by a following selector in the same line
eg.

Code:

kern.*;kern.!=debug            -/var/log/messages

All message priorities except debug from the kern facility

I can't see that any of the ones you quoted will affect your 'kern.!=debug' selector.