Linux – What does “-/filepath” ACTION mean in rsyslog configuration

Hitting F1 or h will show you the key. But for reference, the default colors are:

CPU:

• Blue = Low priority threads
• Green = Normal priority threads
• Red = Kernel threads

Memory:

• Green = Used memory
• Blue = Buffers
• Yellow/Orange = Cache

There are a couple of different color-schemes available, you can see them through hitting F2.

The ftp facility will end up being ignored if your platform does not define LOG_FTP. This is probably the reason why -- it's interesting to note that ftp isn't included as a valid facility in the rsyslog.conf manpage, most likely to avoid having to explain it.

* Mon Oct 12 18:29:44 CEST 1998: Martin Schulze <joey@infodrom.north.de>
*      Added `ftp' facility which was introduced in glibc version 2.
*      It's #ifdef'ed so won't harm with older libraries.

Looking at the source code, you can see where this happens in runtime/srutils.c:

syslogName_t    syslogFacNames[] = {
    {"auth",         LOG_AUTH},
    {"authpriv",     LOG_AUTHPRIV},
    {"cron",         LOG_CRON},
    {"daemon",       LOG_DAEMON},
    {"kern",         LOG_KERN},
    {"lpr",          LOG_LPR},
    {"mail",         LOG_MAIL},
    {"mark",         LOG_MARK},             /* INTERNAL */
    {"news",         LOG_NEWS},
    {"security",     LOG_AUTH},             /* DEPRECATED */
    {"syslog",       LOG_SYSLOG},
    {"user",         LOG_USER},
    {"uucp",         LOG_UUCP},
#if defined(LOG_FTP)
    {"ftp",          LOG_FTP},
#endif
    {"local0",       LOG_LOCAL0},
    {"local1",       LOG_LOCAL1},
    {"local2",       LOG_LOCAL2},
    {"local3",       LOG_LOCAL3},
    {"local4",       LOG_LOCAL4},
    {"local5",       LOG_LOCAL5},
    {"local6",       LOG_LOCAL6},
    {"local7",       LOG_LOCAL7},
    {NULL,           -1},
};

The - behavior is a bit nuanced. You'll need three URLs for the complete picture.

• Documentation of the - behavior -- Search for "syncing"
• Note about the default behavior change with syncing in V3
• Documentation of $ActionFileEnableSync

The short version: as of V3, a - prefix by itself specifies if you want a file to be omitted from disk syncing, but this is only meaningful if syncing has been enabled at all with $ActionFileEnableSync on.

It's still useful to include the syntax in your configuration if you operate with a mixed syslog daemon environment and there is a practice of sharing compatible configs between servers.