Sidebar: About /etc/syslog.conf

/etc/syslog.conf is responsible for prioritizing and routing accounting and log messages (see Listing 3). The first field is the priority level, the second is the information destination. The priority field is broken into sets of subfield pairs. The pairs are comprised of log types (or message-generating facilities) and message severity level, separated by a dot. Multiple pairs are separated by a semicolon. The first line in Listing 3 defines the destination of mail message information. The .debug priority means send all data regardless of priority. Thus, any mail-related warnings or error messages will be reported to /usr/spool/mqueue/syslog. Likewise, all messages received via local0 are routed to /usr/adm/isdn.log.

The syntax of the priority field takes a little getting used to. All messages at the alert level and above will be routed to both the console and root, if root is logged in. All messages at the emergency level will be routed to everyone logged in. All messages at the info(rmational) level will be routed to /usr/adm/syslog, with the exception (and here's the complication) of messages from local0, and mail. That is accomplished with the .none priority.

.none is the opposite of .debug. It disables all facilities listed before it, but after the ";". In this case, .none ensures local0 and mail information level messages already sent elsewhere won't be duplicated in /usr/adm/syslog. Notice that alert and emergency level messages _ including those regarding the ISDN connection and mail _ will be duplicated at the console, and sent to root and all others currently logged in.