0

Ubuntu 22.04 and postfix 3.6.4

Postfix config is set to use syslog_facility=mail, and I have modified /etc/rsyslog.d/50-default.conf to the following

*.*;mail,auth,authpriv.none     -/var/log/syslog
mail.warn                       /var/log/mail.err

Messages of warning and higher are correctly going to /var/log/mail.err, however all levels of mail facility messages are still going to syslog. Am I missing something?

Brett A.
  • 156
  • 9
  • Looks good to me, maybe missing a `systemctl restart rsyslogd`? Whats the point though? In Ubuntu 22.04 syslog is owned by systemd, rsyslog being demoted to just one way to process it. So why not have whatever application you want to read those file dynamically filter like `journalctl -o short-iso -u postfix@-.service -u example.service -u other.service -p 4` and generate precisely what you need, instead of rough selections stored in flat text files? – anx Mar 09 '23 at 20:06
  • 1
    @anx this is a business requirement. these logs are being ingested into Splunk and stored into specific indexes, and the indexes have RBAC on them. The Splunk Universal Forwarder on the servers do not support filtering, otherwise I would do it before sending the logs to Splunk for processing. Hence, why I need them separated out from syslog. – Brett A. Mar 09 '23 at 21:18
  • @anx Nothing changed overnight except for the passage of time. Logging is working as expected today. Thanks for taking the time to respond! – Brett A. Mar 10 '23 at 17:43

1 Answers1

1

Try the following:

Insert mail.none for /var/log/syslog

For example:

*.info;mail.none;authpriv.none;cron.none                /var/log/syslog

And then log postfix messages into separate files:

# Log all the mail messages in one place.

mail.*               -/var/log/mail
mail.info            -/var/log/mail.info
mail.warning         -/var/log/mail.warn
mail.err             /var/log/mail.err
M. Behrens
  • 316
  • 2
  • 4