kern too. There's already this: | kern.* -/var/log/kern.log
So: | *.*;auth,authpriv.none -/var/log/syslog Should exclude both mail and kern (duplicates): | *.*;auth,authpriv,kern,mail.none -/var/log/syslog -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to rsyslog in Ubuntu. https://bugs.launchpad.net/bugs/581360 Title: mail should not log to /var/log/syslog by default Status in rsyslog package in Ubuntu: Confirmed Bug description: Binary package hint: rsyslog Particularly on servers, email should not be logged to /var/log/syslog by default, as this clogs up syslog with tons of stuff that is already being logged to /var/log/mail.log, /var/log/mail.err, /var/log/mail.info, and /var/log/mail.warn by default. Suggested change in the default /etc/rsyslog.d/50-default.conf: - *.*;auth,authpriv.none -/var/log/syslog + *.*;auth,authpriv,mail.none -/var/log/syslog To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/rsyslog/+bug/581360/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp