i am using solaris 10 and saw this line in /etc/syslog.conf*.err;kern.debug;daemon.notice;mail.crit;auth.debug;local2.notice       /var/adm/messagesDoes it mean that, if I have a auth.err, the error message will appear in my /var/adm/message twice due to the:*.err  auth.debug If let's say I also have another line which is:*.emerg  **.err;kern.debug;daemon.notice;mail.crit;auth.debug;local2.notice       /var/adm/messagesDoes it mean that, if i have a kernel.emerg,  it will log twice to /var/adm/messages due to *.emerg  *   andkern.debug  /var/adm/messages?=======Added onauth.notice         ifdef(`LOGHOST', /var/log/authlog, @loghost) how does syslog check if this machine is a loghost or not ?by checking the /etc/hosts for the loghost aliase and see if it matches the IP of the machine  ?I have syslog.conf without ifdef and it still works, is ifdef necessary or not ?
syslog configuration - repeated alert?
solaris;syslog
The rules are mostly defining filters applied at runtime to each message, so in reality, you are not supposed to have duplicated messages in the same destination/file.Multiple selectors may be specified for a single action using the  semicolon ('';'') separator. Remember that each selector in the  selector field is capable to overwrite the preceding ones.You can and do get however, the same message sent to different files, including the console.In the case of*.emerg *Which is shorthand to all users in syslog, it will to all users. Everyone logged onEmergency messages often go to all users currently online to notify  them that something strange is happening with the system. To specify  this wall(1)-feature use an asterisk (''*'').So indeed, in a kernel.emerg,  will  both send it to all users, and to /var/adm/messages at the same; however it will be only one line in /var/adm/messages.The behavior of the original BSD syslogd is that all messages of the  specified priority and higher are logged according to the given  action.Quotes taken from syslog.conf man page:syslog.conf(5) man pageas for the ifdef, taking as an example:auth.notice         ifdef(`LOGHOST', /var/log/authlog, @loghost) If LOGHOST is defined (i.e. this syslog is a LOGHOST, it will send the log/message to /var/log/authlog, otherwise will sent it to @loghost.As for ifdef it is not a requirement, and as for LOGHOST, according to this page it is the name of the machine taken from the file /etc/hosts (or possibly DNS, only testing)To edit /etc/hosts  (./inet/hosts) and add one or several lines that  defines IP address for loghost (Name is arbitrary, and if several  remote hosts are defined you can use any name you wish)