# Understanding syslog.conf



## Helmut (Jan 9, 2018)

Hi,

I want to understand syslog.conf and place files at /etc/syslog.d. The last lines of syslog.conf (11.1-RELEASE) are

```
!ppp
*.*                                             /var/log/ppp.log
!*
include                                         /etc/syslog.d
include                                         /usr/local/etc/syslog.d
```
What does !* mean here? Where is the difference to *.*, e.g. at

```
# uncomment this to enable logging of all log messages to /var/log/all.log
# touch /var/log/all.log and chmod it to mode 600 before it will work
#*.*                                            /var/log/all.log
```
?

Thank you!


----------



## SirDice (Jan 9, 2018)

Helmut said:


> I want to understand syslog.conf


Start by reading syslog.conf(5).


----------



## Helmut (Jan 9, 2018)

SirDice said:


> Start by reading syslog.conf(5).



I did of course. !ftp would result in logging all messages from ftp, *.* logs all messages from all facilities and all priorities. So !* logs all programs and *.* logs all messages. But why not

!*
*.* /var/log/all.log

but only

*.* /var/log/all.log

?


----------



## SirDice (Jan 9, 2018)

Helmut said:


> So !* logs all programs


No, !* "resets" the filter. 


```
A program or hostname specification may be	reset by giving	the program or
     hostname as `*'.
```


----------

