0

First: I'm using Ubuntu Server Linux - 3.13.0-29-generic #53-Ubuntu SMP Wed Jun 4 21:00:20 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux with rsyslogd 7.4.4

I would very much like to make sense of the contents of /etc/rsyslog.d/50-default.conf in the hopes of one day creating some custom rules for myself to redirect some of the messages to other logfiles.

Could someone please point me to a beginner's tutorial or something?

What I've already tried (and didn't give me the info I need):

  • man rsyslogd
  • man rsyslog.conf
  • Ubuntu's rsyslog documentation. Lots of info there, but not what I was looking for.
  • various pages on RSysLog.com do mention some of the default rules, but offer insufficient explanation of the syntax. Apparently, there is a new syntax now which seems to be documented better (I haven't looked at it in detail yet), but that's not what I'm looking for.

As far as I can find out I'm really trying to find out about the "old" syntax. Any suggestions what I should be looking for/at are welcome.

Improve this question

1 Answer 1

Reset to default
1

Read man 3 syslog;man logger to understand the facility and priority concepts. Play with logger.

I finally tracked down this which has Unix/Linux Lore about the "-" in it! It says, in part:

What's that dash in front of the filename? It's not documented in the man page, but it turns out to mean "Don't sync after every write to the file". Except that rsyslogd won't sync anyway, unless you add a special directive in the Global Directives section. So for most people, a dash makes no difference one way or the other -- it will be ignored.

So why is it there in the file, especially since the man page doesn't even document it? I have no idea; probably no one from the various distros has audited these files for years.

Improve this answer
4
  • Still, the minus - sign in front of some paths baffles me.
    – Mausy5043
    Jun 14, 2014 at 8:18
  • @Mausy5043 I think it means "use synchronous writes", but I cannot recall why I think that, or where I found out.
    – waltinator
    Jun 17, 2014 at 4:14
  • 1
    Mausy5043 It turns out I was 100% incorrect! Except for the part about being unable to recall.
    – waltinator
    Jun 29, 2014 at 5:07
  • Thanks for revisiting this question. It makes a lot more sense now.
    – Mausy5043
    Jun 29, 2014 at 16:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .