something about maillog

Previous Topic Next Topic
 
classic Classic list List threaded Threaded
4 messages Options
Reply | Threaded
Open this post in threaded view
|

something about maillog

Jorge E. Rojas
hi

somebody can tell me how (if possible) have a full date (i.e. with the
year) in the maillog  ?


thanks in advance

jorge e.

Reply | Threaded
Open this post in threaded view
|

Re: something about maillog

Victor Duchovni
On Thu, Nov 20, 2008 at 09:32:03PM -0500, Jorge E. Rojas wrote:

> hi
>
> somebody can tell me how (if possible) have a full date (i.e. with the
> year) in the maillog  ?

Use syslog-ng. On Linux systems:

    destination mail {
            file("/var/log/mail/$YEAR/$MONTH/$DAY/$HOUR"
            template("$ISODATE $HOST $MSG\n") template_escape(no)
            owner("root") group("log") perm(0640)
            dir_owner("root") dir_group("log")
            dir_perm(02750) create_dirs(yes));
        };
    destination msgs {
            file("/var/log/msgs/$YEAR/$MONTH/$DAY/$HOUR"
            template("$ISODATE $HOST $MSG\n") template_escape(no)
            owner("root") group("log") perm(0640)
            dir_owner("root") dir_group("log")
            dir_perm(02750) create_dirs(yes));
        };
    source local { unix-dgram("/dev/log"); pipe("/proc/kmsg"); internal(); };
    filter mail { facility(mail); };
    filter notmail { not facility(mail); };
    log { source(local); filter(mail); destination(mail); };
    log { source(local); filter(notmail); destination(msgs); };

The essential elements are

    - "unix-dgram" NOT "unix-stream" log socket
    - template() to customize the log format.
    - Time-based file names obviate the need for log "rotation" scripts,
      just compress old-enough files, and eventually delete them. No need
      to "kill -HUP" the syslog server, and thus no lost messages.
    - Date-based file names make it easier to rsync logs for collection.
    - "log" group used for ssh access by "log" user to collect logs.

--
        Viktor.

Disclaimer: off-list followups get on-list replies or get ignored.
Please do not ignore the "Reply-To" header.

To unsubscribe from the postfix-users list, visit
http://www.postfix.org/lists.html or click the link below:
<mailto:[hidden email]?body=unsubscribe%20postfix-users>

If my response solves your problem, the best way to thank me is to not
send an "it worked, thanks" follow-up. If you must respond, please put
"It worked, thanks" in the "Subject" so I can delete these quickly.
Reply | Threaded
Open this post in threaded view
|

Re: something about maillog

Wietse Venema
In reply to this post by Jorge E. Rojas
Jorge E. Rojas:
> hi
>
> somebody can tell me how (if possible) have a full date (i.e. with the
> year) in the maillog  ?

The date format is chosen by the syslog() system library function.

        Wietse
Reply | Threaded
Open this post in threaded view
|

Re: something about maillog

Juan Miscaro-2
In reply to this post by Victor Duchovni
2008/11/20 Victor Duchovni <[hidden email]>:
> On Thu, Nov 20, 2008 at 09:32:03PM -0500, Jorge E. Rojas wrote:
>
>> hi
>>
>> somebody can tell me how (if possible) have a full date (i.e. with the
>> year) in the maillog  ?
>
> Use syslog-ng

or rsyslog

/juan