I am relatively new to Linux and syslog. I wanted to take specific messages from syslog.

I put these lines to syslog.conf

*.alert;/var/log/alert.log
*.alert;*.warn /var/log/alert_warn.log
*.alert;*.warn;*.info /var/log/alert_warn_info.log
*.alert;*.warn;*.info;*.debug /var/log/alert_warn_info_debug.log

I read somewhere that I would have get seperate logs from syslog.
So, alert.log should have only alert logs
alert_warn.log should have all alert + warn logs
alert_warn_info.log should have all alert + warn + info logs

But to my surprise , alert_warn.log has fewer lines than alert.log

What did I do wrong?

Thank you

I tried to make pure separate .log files for alert , info ,.err, .debug
These pure alert, or pure info contaon more than than the combined log files for alert+info or other combinations.