Your message dated Fri, 18 Apr 2025 23:03:27 +0200
with message-id <[email protected]>
and subject line Re: rsyslog: please allow disabling of Debian standard log
files
has caused the Debian Bug report #488880,
regarding 50-default.conf
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
488880: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=488880
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: rsyslog
Version: 4.6.4-1
Severity: normal
Tags: patch
Justification: Policy 9.3.2
User: [email protected]
Usertags: origin-ubuntu natty ubuntu-patch
Hello,
In Ubuntu we added the configuration file 50-default.conf containing the
default rules for rsyslog and we think you might be interested in adding
it too. Attaching the patch.
diff -pruN 4.2.0-2/debian/50-default.conf 4.2.0-2ubuntu8/debian/50-default.conf
--- 4.2.0-2/debian/50-default.conf 1970-01-01 01:00:00.000000000 +0100
+++ 4.2.0-2ubuntu8/debian/50-default.conf 2010-02-25 01:33:00.000000000 +0000
@@ -0,0 +1,68 @@
+# Default rules for rsyslog.
+#
+# For more information see rsyslog.conf(5) and /etc/rsyslog.conf
+
+#
+# First some standard log files. Log by facility.
+#
+auth,authpriv.* /var/log/auth.log
+*.*;auth,authpriv.none -/var/log/syslog
+#cron.* /var/log/cron.log
+daemon.* -/var/log/daemon.log
+kern.* -/var/log/kern.log
+lpr.* -/var/log/lpr.log
+mail.* -/var/log/mail.log
+user.* -/var/log/user.log
+
+#
+# Logging for the mail system. Split it up so that
+# it is easy to write scripts to parse these files.
+#
+mail.info -/var/log/mail.info
+mail.warn -/var/log/mail.warn
+mail.err /var/log/mail.err
+
+#
+# Logging for INN news system.
+#
+news.crit /var/log/news/news.crit
+news.err /var/log/news/news.err
+news.notice -/var/log/news/news.notice
+
+#
+# Some "catch-all" log files.
+#
+*.=debug;\
+ auth,authpriv.none;\
+ news.none;mail.none -/var/log/debug
+*.=info;*.=notice;*.=warn;\
+ auth,authpriv.none;\
+ cron,daemon.none;\
+ mail,news.none -/var/log/messages
+
+#
+# Emergencies are sent to everybody logged in.
+#
+*.emerg *
+
+#
+# I like to have messages displayed on the console, but only on a virtual
+# console I usually leave idle.
+#
+#daemon,mail.*;\
+# news.=crit;news.=err;news.=notice;\
+# *.=debug;*.=info;\
+# *.=notice;*.=warn /dev/tty8
+
+# The named pipe /dev/xconsole is for the `xconsole' utility. To use it,
+# you must invoke `xconsole' with the `-file' option:
+#
+# $ xconsole -file /dev/xconsole [...]
+#
+# NOTE: adjust the list below, or you'll go crazy if you have a reasonably
+# busy site..
+#
+daemon.*;mail.*;\
+ news.err;\
+ *.=debug;*.=info;\
+ *.=notice;*.=warn |/dev/xconsole
diff -pruN 4.2.0-2/debian/rsyslog.conf 4.2.0-2ubuntu8/debian/rsyslog.conf
--- 4.2.0-2/debian/rsyslog.conf 2010-02-25 01:39:36.000000000 +0000
+++ 4.2.0-2ubuntu8/debian/rsyslog.conf 2010-02-25 01:33:00.000000000 +0000
@@ -2,6 +2,8 @@
#
# For more information see
# /usr/share/doc/rsyslog-doc/html/rsyslog_conf.html
+#
+# Default logging rules can be found in /etc/rsyslog.d/50-default.conf
diff -pruN 4.2.0-2/debian/rsyslog.install 4.2.0-2ubuntu8/debian/rsyslog.install
--- 4.2.0-2/debian/rsyslog.install 2010-02-25 01:39:36.000000000 +0000
+++ 4.2.0-2ubuntu8/debian/rsyslog.install 2010-02-25 01:33:00.000000000 +0000
@@ -1,4 +1,5 @@
debian/rsyslog.conf /etc/
+debian/50-default.conf /usr/share/rsyslog
debian/tmp/usr/sbin/
debian/tmp/usr/share/man/
debian/tmp/usr/lib/rsyslog/imfile.so
diff -pruN 4.2.0-2/debian/rsyslog.postinst 4.2.0-2ubuntu8/debian/rsyslog.postinst
--- 4.2.0-2/debian/rsyslog.postinst 2010-02-25 01:39:36.000000000 +0000
+++ 4.2.0-2ubuntu8/debian/rsyslog.postinst 2010-02-25 01:33:00.000000000 +0000
@@ -58,13 +58,36 @@ case "$1" in
rotate_old_log_files
fi
# Update init script priorities
if dpkg --compare-versions "$2" lt "3.20.2-1"; then
for i in 0 6 ; do
if [ -e /etc/rc$i.d/K90rsyslog ]; then
mv /etc/rc$i.d/K90rsyslog /etc/rc$i.d/S30rsyslog
+ user_conf=/etc/rsyslog.d/50-default.conf
+ default_conf=/usr/share/rsyslog/50-default.conf
diff -pruN 4.2.0-2/debian/rsyslog.postrm 4.2.0-2ubuntu8/debian/rsyslog.postrm
--- 4.2.0-2/debian/rsyslog.postrm 2010-02-25 01:39:36.000000000 +0000
+++ 4.2.0-2ubuntu8/debian/rsyslog.postrm 2010-02-25 01:33:00.000000000 +0000
@@ -13,6 +13,20 @@ fi
if [ "$1" = "remove" ]; then
# Cleanup sendsigs omit file to avoid false positives from piuparts
rm -f /lib/init/rw/sendsigs.omit.d/rsyslog
rm -f /lib/init/rw/sendsigs.omit.d/rsyslog-kmsg
+fi
+
+if [ "$1" = "purge" ]; then
+ if which ucfr >/dev/null; then
+ ucfr --purge rsyslog /etc/rsyslog.d/50-default.conf
+ fi
+ if which ucf >/dev/null; then
+ ucf --purge /etc/rsyslog.d/50-default.conf
+ fi
+ if [ -d /etc/rsyslog.d ]; then
+ rm -f /etc/rsyslog.d/50-default.conf
+ rmdir --ignore-fail-on-non-empty /etc/rsyslog.d
+ fi
fi
--- End Message ---
--- Begin Message ---
This is an *old* bug report, I know...
On Sat, 28 Dec 2024 07:34:25 +0100 Josip Rodin
<[email protected]> wrote:
Hi,
I noticed recently on some older machines how my /var/log/ was getting
spammed by duplicate messages, and was very happy to see that newer machines
aren't suffering from it, because of the cleanups in the global rules done
a couple of years back,
https://salsa.debian.org/debian/rsyslog/-/commits/debian/master/debian/rsyslog.conf?ref_type=heads
This helps alleviate some of the concerns from the older comments in this
bug report.
The general issue remains - should the default rsyslog config be split up
into .d/ files. The general trend has been in favor of doing this, because
it should ease customization by users. Are we worried that there are some
dependencies on the files created by the default rules?
I thought about this and concluded that splitting up /etc/rsyslog.conf
is probably not too helpful or rather, it's not clear where and why to
split it.
The good news is, that you can drop in your custom rules in
/etc/rsyslog.d/ and use "& stop" to prevent further processing by the
rules in /etc/rsyslog.conf.
Regards,
Michael
OpenPGP_signature.asc
Description: OpenPGP digital signature
--- End Message ---
