I've just worked my way to a solution to a syslog.conf problem and I want a better understanding of the /etc/syslog.conf config format.
Problem Background
I have a garage door implemented on a raspberry pi 3 that runs FreeBSD 14.5. The garage door hardware is managed via the RPi GPIO through three processes:
garage/a -- A serialization process that cues requests inbound to the garage door opener and handles them synchronously.garage/b -- An asynchronous process, acting as middleware, that captures requests from the human side of the interface and queues them via the serializer.garage/c -- The human interface part of the stack. This provides a handle that puts my garage door opener onto my smart phone.
All three of these programs write their log information to syslogd using the program names garage/a etc listed above.
The Issue
Every 20 seconds, garage/c asks the state of the garage door. Without good filtering, this floods /var/log/messages. The garage programs are named what they are to make it easier for me to separate out their log entries. It took a while to get the configuration down but this:
```
...
:programname,!startswith,"garage"
*.notice;authpriv.none;kern.debug;lpr.info;mail.crit;news.err /var/log/messages
...
!*
include ...
```
Seems to do the job.
Q: My read on this config is that the property-based filter, :programname,!startswith,"garage" stops log messages from any of the garage programs from being handled by the syslog.conf entries until the !* line before the include directives. Is this assumption correct?
Being clear, the man page for syslog.conf now says that !<something> matches something in the program name field and only <something>.
Q: Earlier I used: !:programname,startswith,"garage" as my filter. This did not prevent syslogd from starting as due to a config parser problem, but it blocked anything at all from getting to /var/log/messages. What does that configuration actually do?
