problems with syslogd [solved]

[Amit Aronovitch]

On Thu, Jun 10, 2010 at 8:54 AM, Oron Peled <oron at actcom.co.il> wrote:
>
> On Wednesday, 9 בJune 2010 15:14:44 Amit Aronovitch wrote:
> > Recently I stopped getting any messages in /var/log/messages (and probably
> > ...
> > 1) /etc/syslogd.conf is debian's standard, seems to support
> > /var/log/messages (as ever):
> >
> > *.=info;*.=notice;*.=warn;\
> >     auth,authpriv.none;\
> >     cron,daemon.none;\
> >     mail,news.none        -/var/log/messages
>
> Maybe the filename is separated from the selector by spaces instead
> of tabs? It is important (at least in legacy syslogd), because
> spaces are allow withing the selector expression.
>

Thanks, that nailed it!
 Well, not exactly, but close enough to figure it out:
The separator was tab all right, but the problem was with the
continuation lines. They start with tab. When I delete the initial
tab, everything works fine. Seems like the escaped EOL does not skip
initial whitespace.

I'll report the config bug to Debian.
Also the manpage is definitely misleading: syslog.conf(5) says:
"Every  rule  consists  of  two  fields,  a selector field and an action
       field.  These two fields are separated by one or more spaces  or  tabs."

Also credit to shimi for mentioning the -f flag of strace (saved me
some manpage searching time) - from the trace I saw that it opens the
files in the order they appear in the conf file, but it skips "debug"
and "messages" - which are exactly the ones that have a continuation
line.

   and thanks all the rest who responded. All tips were good ideas.

      Amit