Viktor Dukhovni:
> On Wed, Jul 01, 2020 at 06:04:50PM +0000, Antonio Leding wrote:
>
> > Thanks Wietse - rsyslog template it is then...
>
> Bear in mind that on Linux systems with systemd-journald, even if you
> ultimately forward messages to rsyslog for storage, the logging
> subsystem is substantially deficient, and you SHOULD bypass it.
>
> * With systemd-journald, log entries from multiple processes
> are not always logged in order of arrival. This is because
> it uses stream rather than dgram sockets, so there is no
> longer a single ordered message queue.
>
> * With systemd-journald, there are default rate limits that
> are easily exceeded on busy servers and messages are lost.
>
> * With a single-threaded systemd-journald, the log processing
> is limited to a single CPU, and on a busy server, once that
> process hits 100% CPU, its clients block writing messages
> (stream socket) limiting overall performance.
>
> Avoid systemd-journald, it is not a robust logging system.
Serious deployments will require better logfile management than is
possible by running "postfix logrotate", because that cannot do
things like monitoring file sizes.
Unfortunately the details are very system dependent.
Possible logrotate.conf syntax:
/var/log/postfix {
rotate 10
daily
postrotate
/usr/sbin/postfix reload
endscript
}
Postfix syntax
maillog_file = /var/log/postfix
Wietse
