###Edit: this was valid with the example given in the question to start with. It's since been edited, and the answer by TAFKA 'goldilocks' is the correct one. You're doing it right. When you want to select a different set of log entries, you need to specify it on a separate line, just as you do. The fact that the two selections happen to have the same facility is irrelevant.

If you wanted to do two things to the same set of log entries, you could instead use an ampersand (&) on the second line. E.g. if you wanted to store all syslog messages in both a file and a database:

syslog.* /var/log/syslog.log & :ommysql:localhost,database,user,password 

to reduce the amount of CPU used to evaluate the filter. But that is not the case here, so your solution is the correct one.

Edit: this was valid with the example given in the question to start with. It's since been edited, and the answer by TAFKA 'goldilocks' is the correct one.

You're doing it right. When you want to select a different set of log entries, you need to specify it on a separate line, just as you do. The fact that the two selections happen to have the same facility is irrelevant.

If you wanted to do two things to the same set of log entries, you could instead use an ampersand (&) on the second line. E.g. if you wanted to store all syslog messages in both a file and a database:

syslog.* /var/log/syslog.log & :ommysql:localhost,database,user,password 

to reduce the amount of CPU used to evaluate the filter. But that is not the case here, so your solution is the correct one.

You're doing it right. When you want to select a different set of log entries, you need to specify it on a separate line, just as you do. The fact that the two selections happen to have the same facility is irrelevant.

If you wanted to do two things to the same set of log entries, you could instead use an ampersand (&) on the second line. E.g. if you wanted to store all syslog messages in both a file and a database:

syslog.* /var/log/syslog.log & :ommysql:localhost,database,user,password 

to reduce the amount of CPU used to evaluate the filter. But that is not the case here, so your solution is the correct one.

###Edit: this was valid with the example given in the question to start with. It's since been edited, and the answer by TAFKA 'goldilocks' is the correct one. You're doing it right. When you want to select a different set of log entries, you need to specify it on a separate line, just as you do. The fact that the two selections happen to have the same facility is irrelevant.

If you wanted to do two things to the same set of log entries, you could instead use an ampersand (&) on the second line. E.g. if you wanted to store all syslog messages in both a file and a database:

syslog.* /var/log/syslog.log & :ommysql:localhost,database,user,password 

to reduce the amount of CPU used to evaluate the filter. But that is not the case here, so your solution is the correct one.