> It is assumed that you're not a victim of systemd-journald log mangling.
> It may be dropping some messages, and recording others out of order,
> breaking "collate". On Linux systems where systemd is doing the
> logging, you'll want to have Postfix writing its own log files directly,
> bypassing syslog. I have:
>
> main.cf:
> maillog_file = /var/log/postfix/log
>
> $ ls -ld /var/log/postfix{,/*}
> drwxrwxr-x. 2 root postdrop 47 May 22 23:40 /var/log/postfix
> -rw------- 1 root root 226 May 22 23:40 /var/log/postfix/log
> -rw------- 1 root postdrop 25747944 May 22 23:40
> /var/log/postfix/log.20240522-234048.gz
>
> See https://www.postfix.org/MAILLOG_README.html and note that rotation
> does not (yet) delete old files, that's up to your cron job.
Postfix is now configured for logging at /var/log/postfix.
* added to main.cf:
maillog_file = /var/log/postfix/0522zh.log
* added to master.cf
postlog unix-dgram n - n - 1 postlogd
I then:
[root@mail01 0522zh]# perl ../collate.pl 0522zh.log >0522zh.log.collate
[root@mail01 0522zh]# ll
total 95M
-rw-r--r-- 1 root root 2.5M May 22 11:38 0522zh.log
-rw-r--r-- 1 root root 92M May 22 11:55 0522zh.log.collate
The output of collate does not appear to be useful -- it is the same
as when we are logging to memory.
I then ran:
[root@mail01 0522zh]# cat 0522zh.log.collate | grep -v
'192.168.122.11' >0522zh.log.collate.no_priv
[root@mail01 0522zh]# ll
total 96M
-rw-r--r-- 1 root root 2.5M May 22 11:38 0522zh.log
-rw-r--r-- 1 root root 92M May 22 11:55 0522zh.log.collate
# huge file size once again
-rw-r--r-- 1 root root 865K May 22 12:03 0522zh.log.collate.no_priv.
# reasonable file size after last grep
I scanned the last file. All I see is sequences like this:
May 22 11:30:03 mail01 postfix/smtpd[3177]: discarding EHLO keywords: CHUNKING
May 22 11:31:22 mail01 postfix/cleanup[3357]: 5592A30F1CB9:
message-id=<[email protected]>
May 22 11:31:22 mail01 postfix/qmgr[2563]: 5592A30F1CB9:
from=<zh-devo-bounce+<deleted>[email protected]>,
size=45131, nrcpt=1 (queue active)
May 22 11:31:43 mail01 postfix/qmgr[2563]: 5592A30F1CB9: removed
May 22 11:30:03 mail01 postfix/smtpd[3177]: discarding EHLO keywords: CHUNKING
May 22 11:31:22 mail01 postfix/cleanup[3357]: 93D9D30F1E10:
message-id=<[email protected]>
May 22 11:31:22 mail01 postfix/qmgr[2563]: 93D9D30F1E10:
from=<zh-devo-bounce+<deleted>[email protected]>,
size=45151, nrcpt=1 (queue active)
May 22 11:31:43 mail01 postfix/qmgr[2563]: 93D9D30F1E10: removed
This is not the useful data you were looking for. I can not get this
to work. I would be glad to give you the log file offline.
Best, Greg
_______________________________________________
Postfix-users mailing list -- [email protected]
To unsubscribe send an email to [email protected]
