Am 06.08.2011 07:37, schrieb Stan Hoeppner:
> On 8/5/2011 6:38 AM, Robert Schetterer wrote:
>> Am 05.08.2011 13:31, schrieb Ralf Hildebrandt:
>
>>> Multiple options:
>>>
>>> * use a syslogd which can do filtering (syslog-ng) based on regexp
>>> * or do it this way:
>>>
>>> main.cf:
>>> syslog_facility = local4
>>>
>>> and in syslog.conf:
>>> local4.* -/var/log/mail.log
>>> mail.* -/var/log/pop3d-imapd.log
>
> Thanks Ralf. I may have to try this out. Any downside to using local4
> for mail? I looked into this a while back and decided against it for
> some reason. Can't recall why at this point.
>
>> or use seperate dovecot log file
>> http://wiki.dovecot.org/Logging
>
> Robert I've been using this option for quite a while now. I don't care
> for the fact that one must rotate the files manually, write a one off
> script to do so, or attempt to integrate it with the systems log
> rotation script.
>
> In all fairness though, Timo doesn't own this particular problem. The
> syslog gods have not yet seen fit to include the standard log files
> 'pop' and 'imap'. Ironically, rsyslog, at least the Debian
> implementation of it, includes support for the news service, which is an
> extinct dinosaur...
>
i have this in ubuntu lucid
on a central rsyslog server
( but should work likely local too )
this must not fit to you needs , but may help you having
an idea to solve your needs
/etc/rsyslog.d/50-default.conf
# Default rules for rsyslog.
#
# For more information see rsyslog.conf(5) and
/etc/rsyslog.conf
#
# First some standard log files. Log by facility.
#
auth,authpriv.* /var/log/auth.log
#*.*;auth,authpriv.none -/var/log/syslog
*.*;auth,authpriv.none;mail.none -/var/log/syslog
#cron.* /var/log/cron.log
daemon.* -/var/log/daemon.log
kern.* -/var/log/kern.log
lpr.* -/var/log/lpr.log
mail.* -/var/log/mail.log
user.* -/var/log/user.log
#
# Logging for the mail system. Split it up so that
# it is easy to write scripts to parse these files.
#
mail.info -/var/log/mail.info
mail.warn -/var/log/mail.warn
mail.err /var/log/mail.err
...
# dovecot
:programname, isequal, "dovecot" /var/log/dovecot.log
# postfix
:programname, isequal, "postfix" /var/log/postfix.log
#spamd
:programname, isequal, "spamd" /var/log/spamd.log
#clamav-milter
:programname, isequal, "clamav-milter" /var/log/clamav-milter.log
#relay01
:hostname, isequal, "relay01" /var/log/relay01-mail.log
#relay02
:hostname, isequal, "relay02" /var/log/relay02-mail.log
#mail01
:hostname, isequal, "mail01" /var/log/mail01-mail.log
#mail02
:hostname, isequal, "mail02" /var/log/mail02-mail.log
/etc/logrotate.d/rsyslog
/var/log/mail.log {
dateext
maxage 365
rotate 365
daily
missingok
notifempty
sharedscripts
postrotate
service rsyslog restart >/dev/null 2>&1 || true
endscript
}
/var/log/postfix.log {
prerotate
/usr/sbin/pflogsumm -d today /var/log/postfix.log --problems_first |
/usr/bin/mail -s "Mail Stats today" [email protected]
endscript
dateext
maxage 365
rotate 365
daily
missingok
notifempty
sharedscripts
postrotate
service rsyslog restart >/dev/null 2>&1 || true
endscript
}
/var/log/dovecot.log {
dateext
maxage 365
rotate 365
daily
missingok
notifempty
sharedscripts
postrotate
service rsyslog restart >/dev/null 2>&1 || true
endscript
}
/var/log/spamd.log {
dateext
maxage 365
rotate 365
daily
missingok
notifempty
sharedscripts
postrotate
service rsyslog restart >/dev/null 2>&1 || true
endscript
}
....
--
Best Regards
MfG Robert Schetterer
Germany/Munich/Bavaria
