файл конфигурации rsyslogd (8) (rsyslogd(8) configuration file)
Селекторы (Selectors)
The selector field itself again consists of two parts, a facility
and a priority, separated by a period ('.'). Both parts are case
insensitive and can also be specified as decimal numbers, but
don't do that, you have been warned. Both facilities and
priorities are described in syslog(3). The names mentioned below
correspond to the similar LOG_-values in /usr/include/syslog.h.
The facility is one of the following keywords: auth, authpriv,
cron, daemon, kern, lpr, mail, mark, news, security (same as
auth), syslog, user, uucp and local0 through local7. The keyword
security should not be used anymore and mark is only for internal
use and therefore should not be used in applications. Anyway,
you may want to specify and redirect these messages here. The
facility specifies the subsystem that produced the message, i.e.
all mail programs log with the mail facility (LOG_MAIL) if they
log using syslog.
The priority is one of the following keywords, in ascending
order: debug, info, notice, warning, warn (same as warning), err,
error (same as err), crit, alert, emerg, panic (same as emerg).
The keywords error, warn and panic are deprecated and should not
be used anymore. The priority defines the severity of the
message.
The behavior of the original BSD syslogd is that all messages of
the specified priority and higher are logged according to the
given action. Rsyslogd behaves the same, but has some extensions.
In addition to the above mentioned names the rsyslogd(8)
understands the following extensions: An asterisk ('*') stands
for all facilities or all priorities, depending on where it is
used (before or after the period). The keyword none stands for no
priority of the given facility.
You can specify multiple facilities with the same priority
pattern in one statement using the comma (',') operator. You may
specify as much facilities as you want. Remember that only the
facility part from such a statement is taken, a priority part
would be skipped.
Multiple selectors may be specified for a single action using the
semicolon (';') separator. Remember that each selector in the
selector field is capable to overwrite the preceding ones. Using
this behavior you can exclude some priorities from the pattern.
Rsyslogd has a syntax extension to the original BSD source, that
makes its use more intuitively. You may precede every priority
with an equals sign ('=') to specify only this single priority
and not any of the above. You may also (both is valid, too)
precede the priority with an exclamation mark ('!') to ignore all
that priorities, either exact this one or this and any higher
priority. If you use both extensions then the exclamation mark
must occur before the equals sign, just use it intuitively.
