Hi,
Please remove all actual logging statements from /etc/rsyslog.conf and
replace them with file(s) in /etc/rsyslog.d/.
I make the following change on all machines:
@@ -59,7 +59,7 @@
# First some standard log files. Log by facility.
#
auth,authpriv.* /var/log/auth.log
-*.*;auth,authpriv,kern.none -/var/log/syslog
+*.*;auth,authpriv.none -/var/log/syslog
#cron.* /var/log/cron.log
daemon.* -/var/log/daemon.log
kern.* -/var/log/kern.log
@@ -86,10 +86,10 @@
# Some "catch-all" log files.
#
*.=debug;\
- auth,authpriv,kern.none;\
+ auth,authpriv.none;\
news.none;mail.none -/var/log/debug
*.=info;*.=notice;*.=warn;\
- auth,authpriv,kern.none;\
+ auth,authpriv.none;\
cron,daemon.none;\
mail,news.none -/var/log/messages
On some machines I also remove some other facilities that are noisy from
the syslog and messages log files. On a mail server I remove mail.*, on
some other server I might remove daemon...
This wouldn't be such a big issue, if the format of the config file
never changed, but it has and probably will again. So every day the
package updates, I need to diff it and see what's going on.
--
Aleksi Suhonen
() ascii ribbon campaign
/\ support plain text e-mail
