Hi, I am new to rsyslog. Currently I don't understand, why mail.* messages aren't included in the /var/log/syslog file. This is the default Debian rsyslog.conf:
> [...] > ############### > #### RULES #### > ############### > > # > # First some standard log files. Log by facility. > # > auth,authpriv.* /var/log/auth.log > *.*;auth,authpriv.none -/var/log/syslog > #cron.* /var/log/cron.log > daemon.* -/var/log/daemon.log > kern.* -/var/log/kern.log > lpr.* -/var/log/lpr.log > mail.* -/var/log/mail.log > user.* -/var/log/user.log > > # > # Logging for the mail system. Split it up so that > # it is easy to write scripts to parse these files. > # > mail.info -/var/log/mail.info > mail.warn -/var/log/mail.warn > mail.err /var/log/mail.err > > [...] In my understanding, a message with the facility "mail" and severity "info" comes in, the following should happen: 1. Rule: Does *not* match facility "auth" or "authpriv", so the message won't get into "/var/log/auth.log". The next rule should get processed. 2. Rule: *Does* match facility *and* severity "*.*", so it's included. It doesn't match "auth" or "authpriv.*", so it isn't excluded. => The message *should* get into /var/log/syslog... But it doesn't?! It will be written to /var/log/mail.log (rule "mail.*") and also into /var/log/mail.info (rule "mail.info")... but why won't it also be logged in /var/log/syslog? -- Best wishes, Igor _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
