Write info-and-more-severe messages to /var/log/messages but exclude the mail facility.
Which rsyslog line is appropriate?
Combine selectors with a semicolon and append mail.none to exclude the mail facility from the selected messages.
Detailed explanation
*.info;mail.info /var/log/messagesIncorrect. mail.info adds mail messages rather than excluding them.
Incorrect. mail.info adds mail messages rather than excluding them.
*.info;mail.=none /var/log/messagesIncorrect. none is used as a facility exclusion, not an exact priority.
Incorrect. none is used as a facility exclusion, not an exact priority.
mail.none;*.info /var/log/messagesIncorrect. A later *.info can select mail again.
Incorrect. A later *.info can select mail again.
*.info;mail.none /var/log/messagesCorrect. It selects *.info and excludes mail with mail.none.
Correct. It selects *.info and excludes mail with mail.none.
Try it yourself
An example you can run in a temporary verification environment.
printf '%s
' '*.info;mail.none /var/log/messages' | awk '{print $1, $2}'Expected result
*.info;mail.none /var/log/messagesKey points
- none excludes a facility
- Join selectors with semicolon
- Place exclusion after broad selection
Notes
- Environment: POSIX awk / 模擬設定のみ
- Command output formatting can vary slightly by distribution or tool version.
- Run the example in a temporary directory or process when possible.
Foundation review
Read the scope first
Check whether the command acts on the current shell, a new process, an existing process, or a file.
Verify the observable result
Use the supplied command and compare the output with the expected result.