The /etc/syslog.conf file consists of lines, each containing two fields separated by whitespace (spaces or tabs):

Lines beginning with # are comments. Blank lines are ignored.

The Facility Part

The facility name matches messages from that source category. The wildcard * matches all facilities.

The Priority Part — Important Subtlety

Special priority keywords:

# /etc/syslog.conf — Complete annotated example
# Format: facility.priority [;facility.priority;...]   action
# Priority matching: "this level AND ABOVE"

# ──────────────────────────────────────────────────────────────────
# Kernel messages
# ──────────────────────────────────────────────────────────────────

# All kernel messages → kernel log file
kern.*                          /var/log/kern.log

# Kernel errors and above → also to console
kern.err                        /dev/console

# ──────────────────────────────────────────────────────────────────
# Authentication messages (login, sudo, sshd)
# ──────────────────────────────────────────────────────────────────

# All auth messages → secure log (read by root only, mode 600)
auth,authpriv.*                 /var/log/auth.log

# ──────────────────────────────────────────────────────────────────
# System daemon messages
# ──────────────────────────────────────────────────────────────────

# Daemon info and above → daemon log
daemon.*                        /var/log/daemon.log

# ──────────────────────────────────────────────────────────────────
# Mail system
# ──────────────────────────────────────────────────────────────────

# All mail logs — leading '-' disables fsync for performance
mail.*                          -/var/log/mail.log
mail.err                        /var/log/mail.err

# ──────────────────────────────────────────────────────────────────
# Cron daemon
# ──────────────────────────────────────────────────────────────────

cron.*                          /var/log/cron.log

# ──────────────────────────────────────────────────────────────────
# Debug messages (all facilities, debug level only)
# Exclude auth (security-sensitive) and mail (noisy)
# ──────────────────────────────────────────────────────────────────

# Multiple selectors: match daemon.debug BUT NOT auth or mail
*.debug;auth.none;mail.none     -/var/log/debug

# ──────────────────────────────────────────────────────────────────
# General syslog — catch-all for info and above
# Exclude kern (already in kern.log) and auth (already in auth.log)
# ──────────────────────────────────────────────────────────────────

*.info;kern.none;auth.none;mail.none    /var/log/syslog

# ──────────────────────────────────────────────────────────────────
# Emergency messages — broadcast to ALL logged-in users
# ──────────────────────────────────────────────────────────────────

*.emerg                         *

# ──────────────────────────────────────────────────────────────────
# Your custom daemon using LOG_LOCAL0
# ──────────────────────────────────────────────────────────────────

local0.*                        /var/log/myapp.log
local0.err                      /var/log/myapp.err

# ──────────────────────────────────────────────────────────────────
# Remote logging — forward all errors to central log server
# ──────────────────────────────────────────────────────────────────

*.err                           @192.168.1.100
# OR using TCP (rsyslog):
# *.err                         @@log.example.com

The none keyword is used to explicitly exclude a facility from a selector. This is essential when you have a catch-all selector like *.* but want to exclude certain facilities that go to their own dedicated files.

# Scenario: You want ALL messages in /var/log/everything.log
# but kernel messages should NOT go there (they're in kern.log)
# and auth messages should NOT go there (they're in auth.log, mode 600)

# WRONG — sends everything including sensitive auth messages:
*.*                             /var/log/everything.log

# CORRECT — exclude kern and auth using .none:
*.*;kern.none;auth.none         /var/log/everything.log

# Another example: debug-level messages from all except mail:
*.debug;mail.none               -/var/log/debug.log

Complete example: a daemon that uses LOG_LOCAL1, combined with syslog.conf configuration to route its messages to a dedicated file.

/* myservice_daemon.c
 * Uses LOG_LOCAL1 facility so syslog.conf can route it separately */
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <signal.h>
#include <syslog.h>
#include <fcntl.h>
#include <sys/stat.h>

static volatile sig_atomic_t running = 1;
static volatile sig_atomic_t reload  = 0;

void handle_sigterm(int s) { running = 0; }
void handle_sighup(int s)  { reload  = 1; }

void setup_signals(void)
{
    struct sigaction sa;
    sigemptyset(&sa.sa_mask);
    sa.sa_flags   = SA_RESTART;

    sa.sa_handler = handle_sigterm;
    sigaction(SIGTERM, &sa, NULL);

    sa.sa_handler = handle_sighup;
    sigaction(SIGHUP, &sa, NULL);

    /* Ignore SIGPIPE — common in network daemons */
    sa.sa_handler = SIG_IGN;
    sigaction(SIGPIPE, &sa, NULL);
}

int main(void)
{
    /* Open syslog BEFORE daemonizing (before close all fds) */
    openlog("myservice", LOG_PID | LOG_NDELAY, LOG_LOCAL1);
    syslog(LOG_NOTICE, "myservice starting");

    /* ---- Daemonize ---- */
    pid_t pid = fork();
    if (pid < 0) { syslog(LOG_ERR, "fork: %m"); return 1; }
    if (pid > 0) _exit(0);

    if (setsid() == -1) { syslog(LOG_ERR, "setsid: %m"); return 1; }

    pid = fork();
    if (pid < 0) { syslog(LOG_ERR, "fork2: %m"); return 1; }
    if (pid > 0) _exit(0);

    umask(0);
    chdir("/");

    int devnull = open("/dev/null", O_RDWR);
    dup2(devnull, 0); dup2(devnull, 1); dup2(devnull, 2);
    if (devnull > 2) close(devnull);
    /* ---- End Daemonize ---- */

    setup_signals();

    syslog(LOG_INFO, "myservice daemon running (PID=%d)", getpid());
    syslog(LOG_DEBUG, "Debug messages visible only if syslog.conf routes local1.debug");

    int cycle = 0;
    while (running) {
        if (reload) {
            reload = 0;
            syslog(LOG_INFO, "SIGHUP received — reloading configuration");
            /* load_config() here */
        }

        if (cycle % 10 == 0)
            syslog(LOG_INFO, "Service heartbeat, cycle=%d", cycle);

        if (cycle % 50 == 0)
            syslog(LOG_DEBUG, "Detailed debug: cycle=%d pid=%d", cycle, getpid());

        cycle++;
        sleep(1);
    }

    syslog(LOG_NOTICE, "myservice stopped (cycles=%d)", cycle);
    closelog();
    return 0;
}

Add to /etc/syslog.conf (then send SIGHUP to syslogd):

# Route all myservice messages to its own log file
local1.*                        /var/log/myservice.log

# Route only errors to the general error log as well
local1.err                      /var/log/error.log

# Compile and run
gcc -o myservice_daemon myservice_daemon.c
sudo ./myservice_daemon

# Apply syslog.conf changes (reload syslogd):
sudo kill -HUP $(pidof syslogd)
# OR on systemd:
sudo systemctl reload rsyslog

# Monitor the dedicated log:
sudo tail -f /var/log/myservice.log

# Send SIGHUP to the daemon (reload config):
sudo kill -HUP $(pidof myservice_daemon)

# Graceful stop:
sudo kill -TERM $(pidof myservice_daemon)

A utility that sends one test message at every facility/level combination to help verify your syslog.conf routing is working correctly.

#include <stdio.h>
#include <syslog.h>
#include <unistd.h>

/* All facility names and their codes */
static struct { const char *name; int code; } facilities[] = {
    {"kern",    LOG_KERN},
    {"user",    LOG_USER},
    {"mail",    LOG_MAIL},
    {"daemon",  LOG_DAEMON},
    {"auth",    LOG_AUTH},
    {"syslog",  LOG_SYSLOG},
    {"lpr",     LOG_LPR},
    {"news",    LOG_NEWS},
    {"cron",    LOG_CRON},
    {"local0",  LOG_LOCAL0},
    {"local1",  LOG_LOCAL1},
    {"local2",  LOG_LOCAL2},
    {"local3",  LOG_LOCAL3},
    {"local4",  LOG_LOCAL4},
    {"local5",  LOG_LOCAL5},
    {"local6",  LOG_LOCAL6},
    {"local7",  LOG_LOCAL7},
    {NULL, 0}
};

/* All priority names and their codes */
static struct { const char *name; int code; } priorities[] = {
    {"emerg",   LOG_EMERG},
    {"alert",   LOG_ALERT},
    {"crit",    LOG_CRIT},
    {"err",     LOG_ERR},
    {"warning", LOG_WARNING},
    {"notice",  LOG_NOTICE},
    {"info",    LOG_INFO},
    {"debug",   LOG_DEBUG},
    {NULL, 0}
};

int main(int argc, char *argv[])
{
    printf("syslog routing test — sending to all facilities and priorities\n");
    printf("PID=%d\n\n", getpid());
    printf("Check /var/log/* to see where each message was routed.\n\n");

    for (int f = 0; facilities[f].name != NULL; f++) {
        openlog("syslog_test", LOG_PID | LOG_NDELAY, facilities[f].code);

        for (int p = 0; priorities[p].name != NULL; p++) {
            syslog(facilities[f].code | priorities[p].code,
                   "TEST: facility=%s priority=%s → check routing",
                   facilities[f].name, priorities[p].name);
        }

        closelog();
        usleep(10000);  /* Small delay to avoid flooding */
    }

    printf("Done. Search each log file:\n");
    printf("  grep 'syslog_test' /var/log/syslog | head\n");
    printf("  grep 'syslog_test' /var/log/kern.log | head\n");
    printf("  sudo grep 'syslog_test' /var/log/auth.log | head\n");
    printf("  grep 'syslog_test' /var/log/daemon.log | head\n");

    return 0;
}

gcc -o syslog_routing_test syslog_routing_test.c
sudo ./syslog_routing_test

# See all facilities and levels that went to syslog:
grep "syslog_test" /var/log/syslog | awk '{print $5, $6}' | sort | uniq

# Count messages by destination to verify routing:
sudo grep -c "syslog_test" /var/log/*.log 2>/dev/null