I hoped I don't have to switch to syslog logging. Well, anyway. I changed 10-logging.conf: syslog_facility = uucp and commented out the other log lines. rsyslog.d/50-default.conf: uucp.debug -/var/log/dovecot/debug.log uucp.info -/var/log/dovecot/dovecot.log uucp.warn -/var/log/dovecot/warn.log uucp.err -/var/log/dovecot/error.log uucp.crit -/var/log/warn.log No fancy redirects with rsyslog yet, plain logging by facility and level. But it logs only to /var/log/syslog. As if dovecot sets another facility. I've used uucp in the past with success (not with rsyslog, but with syslog). AFAIK, uucp still exists as a facility in rsyslog. Shouldn't the above work? (Yes, I restarted both daemons.) Kai
# Logging for the mail system. Split it up so that # it is easy to write scripts to parse these files. # mail.info -/var/log/mail.info mail.warn -/var/log/mail.warn mail.err /var/log/mail.err> Am 26.09.2018 um 12:43 schrieb Kai Schaetzl <maillists at conactive.com>: > > I hoped I don't have to switch to syslog logging. Well, anyway. > > I changed > 10-logging.conf: > syslog_facility = uucp > and commented out the other log lines. > > rsyslog.d/50-default.conf: > uucp.debug -/var/log/dovecot/debug.log > uucp.info -/var/log/dovecot/dovecot.log > uucp.warn -/var/log/dovecot/warn.log > uucp.err -/var/log/dovecot/error.log > uucp.crit -/var/log/warn.log > > No fancy redirects with rsyslog yet, plain logging by facility and level. > > But it logs only to /var/log/syslog. As if dovecot sets another facility. > I've used uucp in the past with success (not with rsyslog, but with > syslog). AFAIK, uucp still exists as a facility in rsyslog. > Shouldn't the above work? > > (Yes, I restarted both daemons.) > > Kai > >-------------- next part -------------- An HTML attachment was scrubbed... URL: <https://dovecot.org/pipermail/dovecot/attachments/20180926/ea5f36c3/attachment-0001.html>
Kai Schaetzl wrote on Wed, 26 Sep 2018 12:43:28 +0200:> But it logs only to /var/log/syslogIt seems that "service rsyslog restart" doesn't correctly restart rsyslogd. You have to stop and start it. Then it picks up the changed config. Kai -- Get your web at Conactive Internet Services: http://www.conactive.com
I'm not going to log dovecot to mail, that creates only the same mixup as before, even worse, now postfix and dovecot mixed. I had to stop/start (force-reload would also work) rsyslogd to pick up the changed config. A restart doesn't change the config as with other daemons. Now I can filter lmtp out. Kai -- Get your web at Conactive Internet Services: http://www.conactive.com
This works for splitting off lmtp traffic, for instance.
syslog_facility = uucp
rsyslog:
:msg, contains, "lmtp(" -/var/log/dovecot/lmtp.log
& stop
uucp.=debug -/var/log/dovecot/debug.log
uucp.=info -/var/log/dovecot/dovecot.log
uucp.=warn -/var/log/dovecot/warn.log
uucp.=err -/var/log/dovecot/error.log
uucp.=crit -/var/log/warn.log
plus:
auth,authpriv,cron,daemon,mail,uucp,news.none -/var/log/syslog
(whatever you don't want to see in syslog)
Kai