2 - Raspberry PI Community Projects

• news: Usenet subsystem message (especially from an NNTP — Network News Transfer
Protocol — server that manages newsgroups);
• syslog: messages from the syslogd server, itself;
• user: user messages (generic);
• uucp: messages from the UUCP server (Unix to Unix Copy Program, an old protocol notably
used to distribute e-mail messages);
• local0 to local7: reserved for local use.
Each message is also associated with a priority level. Here is the list in decreasing order:
• emerg: “Help!” There's an emergency, the system is probably unusable.
• alert: hurry up, any delay can be dangerous, action must be taken immediately;
• crit: conditions are critical;
• err: error;
• warn: warning (potential error);
• notice: conditions are normal, but the message is important;
• info: informative message;
• debug: debugging message.
9.5.2. The Configuration File
The syntax of the /etc/rsyslog.conf file is detailed in the rsyslog.conf(5) manual page,
but there is also HTML documentation available in the rsyslog-doc package (/usr/share/doc/
rsyslog-doc/html/index.html). The overall principle is to write “selector” and “action”
pairs. The selector defines all relevant messages, and the actions describes how to deal with
them.
9.5.2.1. Syntax of the Selector
The selector is a semicolon-separated list of subsystem.priority pairs (example: auth.notice;
mail.info). An asterisk may represent all subsystems or all priorities (examples: *.alert or mail.
*). Several subsystems can be grouped, by separating them with a comma (example: auth,mail.
info). The priority indicated also covers messages of equal or higher priority; thus auth.alert
indicates the auth subsystem messages of alert or emerg priority. Prefixed with an exclamation
point (!), it indicates the opposite, in other words the strictly lower priorities; auth.!notice,
thus, indicates messages issued from auth, with info or debug priority. Prefixed with an equal
Chapter 9 — Unix Services
201