On 1/9/2019 5:55 PM, Robert L Mathews wrote:
On 1/9/19 4:05 PM, Curtis wrote:
We recently switched our Postfix mail servers to Ubuntu Server 18, which
uses journald for logging. Since we have monitoring systems that parse
/var/log/maillog, we enabled rsyslog with imuxsock so we still can parse
the log like we did before journald. But, it's unreliable.
Our monitoring systems are reporting failed deliveries of messages
because of missing log lines in /var/log/maillog.
We had this problem. It was fixed by putting this in
/etc/systemd/journald.conf:
# allow for busy mail logs; allows 1000 per second
RateLimitInterval=5s
RateLimitBurst=5000
And/or by putting this into /etc/rsyslog.conf:
$SystemLogRateLimitInterval 0
(The latter is supposedly no longer necessary, but it used to be, and
does not appear to be harmful.)
Thanks for your input. Unfortunately, even after playing with these
settings, we see no improvement. When you run "systemctl status
systemd-journald" do you see any messages like this?
Jan 28 18:16:01 [somehost] systemd-journald[25662]: Forwarding to syslog
missed 6 messages.
If others are not seeing this issue, then I am wondering if it has
something to do our setup being inside of an LXC container.
For now, we ended up fixing our log parsing script to make journalctl
calls so that no lines are missed. Overall, journald seems like a huge
downgrade for us... I get the impression it was designed for desktop
users, not for servers.
That said, I noticed in another thread that Wietse announced that
Postfix has an option to log to a file now...
ftp://ftp.porcupine.org/mirrors/postfix-release/experimental/postfix-3.4-20190127-nonprod-logger.RELEASE_NOTES
We're not ready to upgrade right now, but I'm looking forward to trying
this option out in the future.
