# newbie question regarding syslog.conf



## battleship_potemkin (Mar 27, 2012)

Hi all,

I've got a newbie question regarding syslog.conf and I would appreciate your help with that.

I have a pretty much standard syslog config, apart from 'enabled' all.log and dedicated PostgreSQL logging at the end.



```
$ cat /etc/syslog.conf | grep -v "^#"
*.notice;authpriv.none;kern.debug;lpr.info;mail.crit;news.err   /var/log/messages
security.*                                      /var/log/security
auth.info;authpriv.info                         /var/log/auth.log
mail.info                                       /var/log/maillog
lpr.info                                        /var/log/lpd-errs
ftp.info                                        /var/log/xferlog
cron.*                                          /var/log/cron
*.=debug                                        /var/log/debug.log
*.emerg                                         *
*.*                                             /var/log/all.log

!postgres
*.*     /var/log/postgresql.log
```


My question is: from what I understood, the last part sends all PostgreSQL messages to /var/log/postgresql.log - and that works fine. But how can I exclude PostgreSQL messages (and, probably, other messages) from /var/log/all.log?

I tried 
	
	



```
'*.*;postgres.none'
```
 and other options, but with no luck.

Any assistance would be appreciated.

Thank you.


----------



## mix_room (Mar 28, 2012)

&quot said:
			
		

> A program specification is a line beginning with `#!prog' or `!prog' (the former is for compatibility with the previous syslogd, if one is sharing syslog.conf files, for example) and the following blocks will be associated with calls to syslog(3) from that specific program.  A program specification for `foo' will also match any message logged by the kernel with the prefix `foo: '.  The `#!+prog' or `!+prog' specification works just like the previous one, and the `#!-prog' or `!-prog' specification will match any message but the ones from that program.  Multiple programs maybe listed, separated by commas: `!prog1,prog2' matches messages from either program, while `!-prog1,prog2' matches all messages but those from `prog1' or `prog2'.



Perhaps something like below works: 


```
!-postgres
*.*     all.log
```


----------



## battleship_potemkin (Mar 29, 2012)

mix_room said:
			
		

> Perhaps something like below works:
> 
> 
> ```
> ...



Wonderful - it works, thank you a lot!

One final piece - if I want exclude multiple applications, shall I put it like that:


```
!-postgres;!-cron;!-smthelse
*.*     all.log
```

?


----------



## Chris_H (Mar 29, 2012)

Greetings,
 It's a first-match filter. So your last line:

```
*.*	all.log
```
 means everything else. 

Best wishes.

--Chris_H


----------



## battleship_potemkin (Mar 30, 2012)

Hi Chris,



			
				Chris_H said:
			
		

> Greetings,
> It's a first-match filter. So your last line:
> 
> ```
> ...



*Y*es, I've got that, thank you! =)
I'm wondering if that is a right syntax to exclude multiple applications from this 'everything else'?

Kind regards,
Alexander.


----------

