I'm adding some custom logging on local0 in syslog.

Writing these messages to a specific log is easy, in my syslog.conf I have

local0.* -/var/log/my.log

But how can I exclude local0 from all other logs? In my current setup, local0 messages also show up in /var/log/syslog since it's specified as

*.*;auth,authpriv.none -/var/log/syslog

Do I need to go through all the other default logs and add local0.none, or is there some kind of global exclude I can use?

2 Answers 2


In syslog I'm afraid your assumption is right, you have to do it by adding local0.none to each syslog line you don't want local0 in.

If you're looking for other options rsyslog is all in nowadays (all the cool kids love it), and will actually let you do what you're asking for (check here).

Also syslog-ng allows you to do what you're asking for, and have some pretty cool filtering by strings even (check here), I use it for advanced syslogging on my log collector server.

  • Would be great with a pointer to where in your rsyslog reference the global exclude is described.
    – sbrattla
    Feb 2, 2015 at 10:42
  • i found this stackexchange link more helpful than the official documentation, in case someone else gets sent here from google searching for the same task using rsyslog Jul 27, 2021 at 10:51

The syslogd manpage states that the exclamation mark is used as a notation for excluding specified priorities, and that "You may use it intuitively as an exception specifier". The example given is

mail.*;mail.!=info              /usr/adm/mail

which would log all mail messages except those with "info" priority. So, for your problem, I'd use

*.*;local0.!debug;auth,authpriv.none /var/log/syslog

or, more readable,

*.*;local0.none;auth,authpriv.none /var/log/syslog

However, you should be aware that I was not able to test this.

  • interesting, isn't mail.*; redundant in the first example? mail.!=info already means everything except info. Jan 18 at 6:53
  • @LogicDaemon Since this was an example from a manpage, I guess the authors explicitely used this notation to show that it's possible to exclude something after explicitely matching everything else.
    – jstarek
    Feb 4 at 17:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.