Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How do I filter from /var/log/syslog (rsyslog.conf/Debian) while keeping messages greater than or equal to mail.warn?

I've tried just about every different variation of appending and prepending different combinations of mail,, mail.!info, mail.*, mail.warn, mail.!warn, but apparently the docs are smarter than me.

Currently I'm at this, but alas, she's a no-go:

*.*;auth,authpriv.none;mail.warn,mail.!info -/var/log/syslog

Edit: I'm having a really hard time understanding the semicolon delimeter and how it "restricts" previous entries.

share|improve this question
Seems like a lot of legit questions I see on serverfault lately have downvotes from the community for no apparent reason. – Jeff Jul 11 '13 at 10:05
You aren't the only one to notice. – Aaron Copley Jul 11 '13 at 17:08
up vote 2 down vote accepted

From the man rsyslog.conf page:

Rsyslogd has a syntax extension to the original BSD source, that makes its use more intuitively. You may precede every priority with an equals sign (=) to specify only this single priority and not any of the above. You may also (both is valid, too) precede the priority with an exclamation mark (!) to ignore all that priorities, either exact this one or this and any higher priority. If you use both extensions than the exclamation mark must occur before the equals sign, just use it intuitively.

So mail.!info means that you are ignoring info priority and any higher priority. Try this:

*.*;auth,authpriv.none;mail.warn,mail.!=info -/var/log/syslog
share|improve this answer

I found a couple of other variations to quanta's answer that also seem to work. I have an idea of why they work, but I'm not confident enough with rsyslog.conf's delimeters and operators to be able to say for sure. Hopefully they help someone else.


    mail.!info,mail.warn     -/var/log/syslog


    auth,authpriv.none       -/var/log/syslog

Any comments on these from someone who knows better would be welcome.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.