Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

following config rules:

auth,authpriv.*                 /var/log/auth.log
*.*;auth,authpriv.none          -/var/log/syslog
#cron.*                         /var/log/cron.log
daemon.*                        -/var/log/daemon.log
ftp.*                           /var/log/vsftpd.log

First 2 lines mean, log everything to syslog except auth and authpriv, log them to auth.log. Cron log is disabled by comment, daemon.* is in both syslog and daemon.log.

ftp.* logs to syslog but not to vsftpd.log, why?

what is the "-" prependet to the path?

I read the manpages but could not find information 'bout that.

share|improve this question
up vote 2 down vote accepted

The ftp facility will end up being ignored if your platform does not define LOG_FTP. This is probably the reason why -- it's interesting to note that ftp isn't included as a valid facility in the rsyslog.conf manpage, most likely to avoid having to explain it.

* Mon Oct 12 18:29:44 CEST 1998: Martin Schulze <>
*      Added `ftp' facility which was introduced in glibc version 2.
*      It's #ifdef'ed so won't harm with older libraries.

Looking at the source code, you can see where this happens in runtime/srutils.c:

syslogName_t    syslogFacNames[] = {
    {"auth",         LOG_AUTH},
    {"authpriv",     LOG_AUTHPRIV},
    {"cron",         LOG_CRON},
    {"daemon",       LOG_DAEMON},
    {"kern",         LOG_KERN},
    {"lpr",          LOG_LPR},
    {"mail",         LOG_MAIL},
    {"mark",         LOG_MARK},             /* INTERNAL */
    {"news",         LOG_NEWS},
    {"security",     LOG_AUTH},             /* DEPRECATED */
    {"syslog",       LOG_SYSLOG},
    {"user",         LOG_USER},
    {"uucp",         LOG_UUCP},
#if defined(LOG_FTP)
    {"ftp",          LOG_FTP},
    {"local0",       LOG_LOCAL0},
    {"local1",       LOG_LOCAL1},
    {"local2",       LOG_LOCAL2},
    {"local3",       LOG_LOCAL3},
    {"local4",       LOG_LOCAL4},
    {"local5",       LOG_LOCAL5},
    {"local6",       LOG_LOCAL6},
    {"local7",       LOG_LOCAL7},
    {NULL,           -1},

The - behavior is a bit nuanced. You'll need three URLs for the complete picture.

The short version: as of V3, a - prefix by itself specifies if you want a file to be omitted from disk syncing, but this is only meaningful if syncing has been enabled at all with $ActionFileEnableSync on.

It's still useful to include the syntax in your configuration if you operate with a mixed syslog daemon environment and there is a practice of sharing compatible configs between servers.

share|improve this answer
Nice explanation, tyvm. I wonder why the facilities ( auth, authpriv, cron, daemon, kern, lpr, mail, mark, news, security (same as auth), syslog, user, uucp and local0 through local7) are so limited? In vsftpd man it sais "syslog_enable If enabled, then any log output which would have gone to /var/log/vsftpd.log goes to the system log instead. Logging is done under the FTPD facility." Even with ftpd instead of ftp it does not work.. – DanFromGermany Jan 22 '13 at 10:57
I think I see what's going on, I've updated my answer. The answer is probably going to end up being your OS. – Andrew B Jan 22 '13 at 11:11
How can I test weather LOG_FTP is defined? Using Debian 6.0.6, rsyslogd 4.6.4 – DanFromGermany Jan 22 '13 at 11:31
That should definitely be recent enough to define LOG_FTP. Did rsyslog generate a 0 byte FTP log when you restarted the daemon? If so, try the following and see if it gets logged. logger -p test If that works, you need to reconfigure vsftpd to actually use syslog. – Andrew B Jan 24 '13 at 21:57
thank you for your help – DanFromGermany Jan 28 '13 at 10:49

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.