Hi, is nobody able to help me to understand what's going on in Debian's rsyslog?
-- Regards, Igor I wrote on 2011-03-28 02:26: > Hi, > > I am new to rsyslog. Currently I don't understand, why mail.* messages > aren't included in the /var/log/syslog file. This is the default > Debian rsyslog.conf: > >> [...] >> ############### >> #### RULES #### >> ############### >> >> # >> # First some standard log files. Log by facility. >> # >> auth,authpriv.* /var/log/auth.log >> *.*;auth,authpriv.none -/var/log/syslog >> #cron.* /var/log/cron.log >> daemon.* -/var/log/daemon.log >> kern.* -/var/log/kern.log >> lpr.* -/var/log/lpr.log >> mail.* -/var/log/mail.log >> user.* -/var/log/user.log >> >> # >> # Logging for the mail system. Split it up so that >> # it is easy to write scripts to parse these files. >> # >> mail.info -/var/log/mail.info >> mail.warn -/var/log/mail.warn >> mail.err /var/log/mail.err >> >> [...] > > In my understanding, a message with the facility "mail" and severity > "info" comes in, the following should happen: > > 1. Rule: > Does *not* match facility "auth" or "authpriv", so the message won't > get into "/var/log/auth.log". > The next rule should get processed. > > 2. Rule: > *Does* match facility *and* severity "*.*", so it's included. > It doesn't match "auth" or "authpriv.*", so it isn't excluded. > > => The message *should* get into /var/log/syslog... > > But it doesn't?! > > It will be written to /var/log/mail.log (rule "mail.*") and also into > /var/log/mail.info (rule "mail.info")... but why won't it also be > logged in /var/log/syslog? > > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
