>> With systemd logging, logs are by default lossy (rate-limits too tight
>> and many users don't notice until it is too late).  Also logging is
> 
> System-wide "defaults to 10000 messages in 30s" and "is applied per-
> service", so this can be easily resolved by providing postfix.service
> with:
> 
> LogRateLimitIntervalSec=0
Unfortunately that's just a start when logging lots of data and
solely using journald.

By default journald keeps about 4 GB of logs, which will only retain a
few hours on a busy server. One might try to overcome that by setting

  SystemMaxUse=10T
  SystemKeepFree=10G

This will raise the bar but journald organizes and splits log data into
several files that are limited as well. It might occur you have not
reached SystemMaxUse but are running out of files, so you set

  SystemMaxFileSize=100G
  SystemMaxFiles=100

You will be surprised that those other limits can interfere with

  MaxRetentionSec=5d
  MaxFileSec=6h

when you discover some needed log data is not available anymore ...

Storing logs in an organized form like journald does, has its advantages
but it's also a lot slower compared to grep on plain log files.

I'm not advising against journald, just to check it meets your needs.

Best regards,
Gerald
_______________________________________________
Postfix-users mailing list -- postfix-users@postfix.org
To unsubscribe send an email to postfix-users-le...@postfix.org

Reply via email to