0

First: I'm using Ubuntu Server Linux - 3.13.0-29-generic #53-Ubuntu SMP Wed Jun 4 21:00:20 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux with rsyslogd 7.4.4

I would very much like to make sense of the contents of /etc/rsyslog.d/50-default.conf in the hopes of one day creating some custom rules for myself to redirect some of the messages to other logfiles.

Could someone please point me to a beginner's tutorial or something?

What I've already tried (and didn't give me the info I need):

  • man rsyslogd
  • man rsyslog.conf
  • Ubuntu's rsyslog documentation. Lots of info there, but not what I was looking for.
  • various pages on RSysLog.com do mention some of the default rules, but offer insufficient explanation of the syntax. Apparently, there is a new syntax now which seems to be documented better (I haven't looked at it in detail yet), but that's not what I'm looking for.

As far as I can find out I'm really trying to find out about the "old" syntax. Any suggestions what I should be looking for/at are welcome.

1

Read man 3 syslog;man logger to understand the facility and priority concepts. Play with logger.

I finally tracked down this which has Unix/Linux Lore about the "-" in it! It says, in part:

What's that dash in front of the filename? It's not documented in the man page, but it turns out to mean "Don't sync after every write to the file". Except that rsyslogd won't sync anyway, unless you add a special directive in the Global Directives section. So for most people, a dash makes no difference one way or the other -- it will be ignored.

So why is it there in the file, especially since the man page doesn't even document it? I have no idea; probably no one from the various distros has audited these files for years.

  • Still, the minus - sign in front of some paths baffles me. – Mausy5043 Jun 14 '14 at 8:18
  • @Mausy5043 I think it means "use synchronous writes", but I cannot recall why I think that, or where I found out. – waltinator Jun 17 '14 at 4:14
  • 1
    Mausy5043 It turns out I was 100% incorrect! Except for the part about being unable to recall. – waltinator Jun 29 '14 at 5:07
  • Thanks for revisiting this question. It makes a lot more sense now. – Mausy5043 Jun 29 '14 at 16:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.