documentation_complete: true

title: 'Ensure Proper Configuration of Log Files'

description: "The file <tt>/etc/rsyslog.conf</tt> controls where log message are written.\nThese are controlled by lines called <i>rules</i>, which consist of a\n<i>selector</i> and an <i>action</i>.\nThese rules are often customized depending on the role of the system, the\nrequirements of the environment, and whatever may enable\nthe administrator to most effectively make use of log data.\nThe default rules in Ubuntu 1404 are:\n<pre>auth,authpriv.*\t\t\t/var/log/auth.log\n*.*;auth,authpriv.none          -/var/log/syslog\ndaemon.*                        -/var/log/daemon.log\nkern.*                          -/var/log/kern.log\nlpr.*                           -/var/log/lpr.log\nmail.*                          -/var/log/mail.log\nuser.*                          -/var/log/user.log\nmail.info                       -/var/log/mail.info\nmail.warn                       -/var/log/mail.warn\nmail.err                        /var/log/mail.err\nnews.crit                       /var/log/news/news.crit\n\
    news.err                        /var/log/news/news.err\nnews.notice                     -/var/log/news/news.notice\n</pre>\nSee the man page <tt>rsyslog.conf(5)</tt> for more information.\n<i>Note that the <tt>rsyslog</tt> daemon is configured to use traditional timestamping\nto be understood by any log processing program. For high precision timestamping,\ncomment the following line in <tt>/etc/rsyslog.conf</tt>:\n<pre>$ ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat</pre>\n</i>"
