syslogd relies on /etc/syslog.conf to tell it how to log messages to files. Most Linux systems already have the associated man page installed. Use man syslog.conf for the most authoritative reference.
Each line of this file has a list of selectors and an action. A selector has two components, the facility (like mail) and the priority (alert). You can also use the asterisk symbol (“*”) to indicate “all”. This means that mail.* specifies all priorities of the facility mail. *.alert, on the other hand, specifies the “alert” priority of all facilities. The exclaimation symbol (“!”) is used to mean “not”. This makes it possible to exclude selectors.
By default, a selector does not select a single priority, but all priorities at or above the specified priority. You can use the equal (“=”) symbol to specify just a single priority level.
Multiple facilities with the same priority/priorities are comma separated. For example, auth,authpriv.* means any priorities of the facilities auth and authpriv.
Full selectors (each specifying the facility/facilities and priority/priorities) are separated by semicolons.
An action specifies what syslogd should do about the selector(s) associated with it. This can be a file (such as /var/log/critical.log), a named pipe, the console itself (/dev/console), a remote machine (@somehost) or the terminal of specific users (root,tauyeung).