16.12.2024 06:05, Wietse Venema via Postfix-users wrote:
Tomasz Pala via Postfix-users:
Again, what about the logging from NON-DAEMON Postfix processes
such as sendmail, postdrop, postqueue, and so on?
They belong to their calling service. Therefore if I run sendmail from
the shell, it belongs to my user's slice. If postdrop is run from
mimedefang-multiplexor.service, it's accounted to mimedefang, not
postfix.service.
Excessive logging by some user won't impact another service.
# echo | postdrop
protocolpostdrop_protocolqueue_id03AD4840693postdrop: warning: stdin:
unexpected EOF reading length, record type 10
postdrop: fatal: uid=0: malformed input
# journalctl -o json-pretty --since -2m
This assues that one already knows when some event of interest
happened.
This is interesting. We've 2 contradicting needs there. And it looks
like both have easy solutions with systemd/journald.
We might view local mail submission as either belonging to the postfix
service or to the service which did the submission. Neither of the two
is right or wrong in all cases, though I'd say the initial submission
belongs more to the submitting service than to the accepting service, -
at least that's where the problem should be dealt with, where it originates
at.
When postfix the service started under systemd control, journald will
collect all logging data produced from any process within that service
unit under the unit name, -- `journalctl -u postfix' to see it (I know
it's different on debian, which is already fixed for the next upload).
This does not include postfix processes started in other contexts, like
submitting mail from command line or from another service - there, it
is logged a belonging to the calling unit, still under postfix-provided
log tag within the message.
But one can view all postfix-related log entries on the system by filtering
not on the service/unit name but on the postfix tag in the message. I
don't remember off-hand how to express this in terms of journalctl options,
but at least, `journalctl -g postfix' would show all log entries with
"postfix" anywhere in the message (-g stands for "grep"). There's also
-t option (syslog tag) and --facility which can be used there, to show
mail-related info from all units.
In other words: the unit/service name in journalctl is an *additional*
tag to search on, not a *replacement* for syslog tags. So either one
of them can be used.
/mjt
_______________________________________________
Postfix-users mailing list -- postfix-users@postfix.org
To unsubscribe send an email to postfix-users-le...@postfix.org
