Greg Sims:
> Hi There,
>
> We recently moved from RHEL 6/Postfix to CentOS 7/Postfix. I see a change
> in the maillog that I need help understanding.
>
> We are using mailman to manage three lists totaling 21K subscribers. Each
> email is sent using VERP so that the Sender and Errors-to headers are
> unique -- containing an encoded version of the email address that the
> email is being sent to. This helps with bounce process and the like. The
> >From header is the same for all of the emails sent and the To header is
> unique.
>
> On the RHEL 6 system, when I count the number of "status=sent" strings in
> the maillog, the number is the same as the number of emails sent. On the
> CentOS 7 system the number of "status=sent" is about 25% of the number of
> emails sent.
>
> Can anyone help me understand this change in behavior?
>
> Here is the command I am using to view the 4/15 emails in the maillog:
>
> cat /var/log/maillog.processed /var/log/maillog | grep status=sent | grep
> 'Apr 15' | wc
> 4783 85852 1221343
>
> You can see 4,783 "status=sent" entries on Apr 15 with over 21K emails sent
> (and verified with DMARC aggregation).
Perhaps system-effing-d is throttling the logs? Reportedly, it does
throttles logs before handing things off to things like rsyslogd.
Wietse
