11

I just started to learn linux with Ubuntu 18.04. When I was reading the config file for rsyslog: /etc/rsyslog.d/50-default.conf , I found that some of the log file directories are having minus signs at their beginning, like the one I pasted below.

mail.*                          -/var/log/mail.log

Only auth and cron do not contain any minus sign among their default log file directories. Does this minus sign mean anything special? Thanks!

muru
  • 193,181
  • 53
  • 473
  • 722
Chaozy
  • 121
  • 1
  • 6

1 Answers1

12

From man rsyslog.conf

To selectively disable syncing for certain files, you may prefix the file path with a minus sign ("-").

The entire paragraph reads:

By default, files are not synced after each write. To enable syncing of log files globally, use either the "$ActionFileEnableSync" directive or the "sync" parameter to omfile. Enabling this option degrades performance and it is advised not to enable syncing unless you know what you are doing. To selectively disable syncing for certain files, you may prefix the file path with a minus sign ("-").

In other words, the '-' retains do-not-sync in case you change the default behavior (Advice: Don't).

This particular question is specific to rsyslog config files. '-' before a normal path anywhere else is usually a syntax error.

user535733
  • 58,040
  • 10
  • 106
  • 136
  • 2
    Yes, unless you *really* require log file integrity for e.g. security audits, then you don't need sync. And if you do, then you shouldn't use files to store your log files but a dedicated log database. – Jörg W Mittag Jun 15 '20 at 14:41
  • 1
    Perhaps it's worth noting that this is something specific to the rsyslog configuration file; it is not a general Linux thing. – marcelm Jun 15 '20 at 19:15
  • 1
    @marcelm good idea. Done! – user535733 Jun 15 '20 at 19:25