On 1/9/19 4:05 PM, Curtis wrote: > We recently switched our Postfix mail servers to Ubuntu Server 18, which > uses journald for logging. Since we have monitoring systems that parse > /var/log/maillog, we enabled rsyslog with imuxsock so we still can parse > the log like we did before journald. But, it's unreliable. > > Our monitoring systems are reporting failed deliveries of messages > because of missing log lines in /var/log/maillog.
We had this problem. It was fixed by putting this in /etc/systemd/journald.conf: # allow for busy mail logs; allows 1000 per second RateLimitInterval=5s RateLimitBurst=5000 And/or by putting this into /etc/rsyslog.conf: $SystemLogRateLimitInterval 0 (The latter is supposedly no longer necessary, but it used to be, and does not appear to be harmful.) -- Robert L Mathews, Tiger Technologies, http://www.tigertech.net/
