CentOS - Jun 2012 - rsyslog.conf - why the "-" in this entry? mail.* -/var/log/maillog

In dealing with an unrelated issue I came across this in rsyslog.conf.

# The authpriv file has restricted access.
authpriv.*                                       /var/log/secure
# Log all the mail messages in one place.
mail.*                                           -/var/log/maillog
# Log cron stuff
cron.*                                           /var/log/cron

Why is there a "-" before /var/log/maillog?  This character is not
present before any of the other log files specified in
/etc/rsyslog.conf.  I have looked in the documents to discover the
purpose of the leading "-" character in the mail log file
specification but either I missed the reference or it is not there to
be found.


-- 
***          E-Mail is NOT a SECURE channel          ***
James B. Byrne                mailto:ByrneJB at Harte-Lyne.ca
Harte & Lyne Limited          http://www.harte-lyne.ca
9 Brockley Drive              vox: +1 905 561 1241
Hamilton, Ontario             fax: +1 905 561 0757
Canada  L8E 3C3

On 06/05/2012 09:30 AM, James B. Byrne wrote:
> In dealing with an unrelated issue I came across this in rsyslog.conf.
> mail.*                                           -/var/log/maillog
> Why is there a "-" before /var/log/maillog?
man syslog.conf
         You may prefix each entry with the minus ??-?? sign to omit 
syncing the
         file  after every logging.  Note that you might lose 
information if the
         system crashes right behind a write attempt.  Nevertheless 
this  might
         give you back some performance, especially if you run programs 
that use
         logging in a very verbose manner.

Le mar. 05 juin 2012 10:30:25 CEST, James B. Byrne a ?crit:
> In dealing with an unrelated issue I came across this in rsyslog.conf.
> 
> # The authpriv file has restricted access.
> authpriv.*                                       /var/log/secure
> # Log all the mail messages in one place.
> mail.*                                           -/var/log/maillog
> # Log cron stuff
> cron.*                                           /var/log/cron
> 
> Why is there a "-" before /var/log/maillog?  This character is
not
> present before any of the other log files specified in
> /etc/rsyslog.conf.
It means that writing to this logfile is not followed by a sync.


-- 
Philippe Naudin

Hello James,

On Tue, 2012-06-05 at 10:30 -0400, James B. Byrne wrote:
> In dealing with an unrelated issue I came across this in rsyslog.conf.
> 
> # The authpriv file has restricted access.
> authpriv.*                                       /var/log/secure
> # Log all the mail messages in one place.
> mail.*                                           -/var/log/maillog
> # Log cron stuff
> cron.*                                           /var/log/cron
> 
> Why is there a "-" before /var/log/maillog?
Better question than it appears at first glance ;) . Nothing in man
rsyslog.conf on C6, but on C5 man syslog.conf it says under "ACTIONS",
"Regular File": 

"You may prefix each entry with the minus ??-?? sign to omit syncing the
file  after every logging.  Note that you might lose information if the
system crashes right behind a write attempt.  Nevertheless  this  might
give you back some performance, especially if you run programs that use
logging in a very verbose manner."

Now whether that minus is still supported under C6 I can't tell you :) .

Regards,
Leonard.

-- 
mount -t life -o ro /dev/dna /genetic/research

On 06/05/2012 07:30 AM, James B. Byrne wrote:
> In dealing with an unrelated issue I came across this in rsyslog.conf.
> [...]
> Why is there a "-" before /var/log/maillog?
[...]

A leading '-' indicates the the log is written asynchronously. It is a 
performance tune to keep writing the syslog from thrashing the system 
with syncs. See http://www.rsyslog.com/doc/rsyslog_conf_actions.html

-- 
Benjamin Franz