Linux Archive

Linux Archive (http://www.linux-archive.org/)
-   Debian User (http://www.linux-archive.org/debian-user/)
-   -   Lenny, rsyslog: eliminate mail logging going to both syslog and mail.log (http://www.linux-archive.org/debian-user/403557-lenny-rsyslog-eliminate-mail-logging-going-both-syslog-mail-log.html)

Tom Furie 07-24-2010 09:43 AM

Lenny, rsyslog: eliminate mail logging going to both syslog and mail.log
 
On Fri, Jul 23, 2010 at 06:56:59PM -0400, Tom H wrote:
> On Fri, Jul 23, 2010 at 3:48 PM, Stan Hoeppner <stan@hardwarefreak.com> wrote:
> > What do I need to modify in /etc/rsyslog.conf to stop mail system logging from
> > going into /var/log/syslog? *Currently it goes to both /var/log/mail.log and
> > to /var/log/syslog.
> >
> > I'm guessing it might have to do with the leading wildcard here:
> >
> > *.*;auth,authpriv.none * * * * *-/var/log/syslog
>
> IIRC
> *.*;!mail.debug;auth,authpriv.none -/var/log/syslog

That will stop debug level messages from the mail system. If you want to
be sure of getting NO mail messages in syslog, then you could use
mail.none. (The clue is in the authpriv entry.)

Cheers,
Tom

--
The ratio of literacy to illiteracy is a constant, but nowadays the
illiterates can read.
-- Alberto Moravia

Stan Hoeppner 07-25-2010 04:51 AM

Lenny, rsyslog: eliminate mail logging going to both syslog and mail.log
 
Tom Furie put forth on 7/24/2010 4:43 AM:
> On Fri, Jul 23, 2010 at 06:56:59PM -0400, Tom H wrote:
>> On Fri, Jul 23, 2010 at 3:48 PM, Stan Hoeppner <stan@hardwarefreak.com> wrote:
>>> What do I need to modify in /etc/rsyslog.conf to stop mail system logging from
>>> going into /var/log/syslog? Currently it goes to both /var/log/mail.log and
>>> to /var/log/syslog.
>>>
>>> I'm guessing it might have to do with the leading wildcard here:
>>>
>>> *.*;auth,authpriv.none -/var/log/syslog
>>
>> IIRC
>> *.*;!mail.debug;auth,authpriv.none -/var/log/syslog
>
> That will stop debug level messages from the mail system. If you want to
> be sure of getting NO mail messages in syslog, then you could use
> mail.none. (The clue is in the authpriv entry.)

Thanks guys. Interesting that the only two folks to respond to my question
are both named Tom. (queue Twilight Zone music) Furie's suggestion did the
trick.

By doing this, will I lose any mail related logging? Anything worth a darn?
I've been running a Debian+Postfix MX for 5 years and I can't recall ever
searching /var/log/syslog for mail related info, but strictly the mail.* logs.
To me the entries in syslog are just been duplicate junk, hence my thread.
Any downsides to this at all? Will it break pflogsumm? I've not looked at
the code so I don't know if it parses syslog or mail.log.

--
Stan


--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
Archive: 4C4BC2CC.30103@hardwarefreak.com">http://lists.debian.org/4C4BC2CC.30103@hardwarefreak.com


All times are GMT. The time now is 11:24 PM.

VBulletin, Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO ©2007, Crawlability, Inc.