DevHeads.net

Problem with logging

Hello!

mail_version = 2.10.1

I have a serious problem with logging of postfix via rsyslog on one of my servers
on CentOS 7.

All I see in the log is

May 12 12:41:39 nimmini1 postfix/qmgr[19227]: E16FE20EA7: from=<a. ... at nimmini dot de>, size=2141, nrcpt=1 (queue active)
May 12 12:41:40 nimmini1 postfix/qmgr[19227]: E16FE20EA7: removed
May 12 12:44:33 nimmini1 postfix/qmgr[19227]: 067DE20F8B: from=< ... at nimmini dot de>, size=1562, nrcpt=1 (queue active)
May 12 12:44:46 nimmini1 postfix/qmgr[19227]: 067DE20F8B: removed
May 12 12:46:07 nimmini1 postgrey[2722]: action=pass, reason=client whitelist, client_name=lists.sourceforge.net, client_address=216.105.38.7, sender=munin-users- ... at lists dot sourceforge.net, recipient= ... at nimmini dot de
May 12 12:46:07 nimmini1 postgrey[2722]: cleaning up old logs...
May 12 12:46:10 nimmini1 postfix/qmgr[19227]: 07F6721582: from=<munin-users- ... at lists dot sourceforge.net>, size=6580, nrcpt=1 (queue active)
May 12 12:46:10 nimmini1 postfix/qmgr[19227]: 07F6721582: removed

A start of postfix is not mentioned. Also the queue-id 19227 (is this a queue-id?) is used for
different actions. Maybe I'm wrong here.

A restart of rsyslog and postfix changes nothing.

journalctl -u postfix shows

Mai 12 13:25:32 nimmini1 systemd[1]: Stopping Postfix Mail Transport Agent...
Mai 12 13:25:32 nimmini1 systemd[1]: Stopped Postfix Mail Transport Agent.
Mai 12 13:25:32 nimmini1 systemd[1]: Starting Postfix Mail Transport Agent...
Mai 12 13:25:32 nimmini1 systemd[1]: Started Postfix Mail Transport Agent.

Any help on this? I enabled verbose logging in master.cf
smtpd pass - - n - - smtpd -v
but have no verbose logging.

Kind regards

Andreas

Comments

Re: Problem with logging

By Viktor Dukhovni at 05/12/2019 - 15:33

Your queue manager might not be chrooted (which is ironic, since it is the
"safest" process to chroot, it typically has the least need for interacting
with the world outside of Postfix). Other services might be chrooted, and
there may not be a log socket for them to write to.

Re: Problem with logging

By Wietse Venema at 05/12/2019 - 15:24

You did not restart systemd, which sits in the middle between Postfix
and rsyslogd, and which has a reputation for breaking Postfix and
other logging.

If you have Postfix 3.4, <a href="http://www.postfix.org/MAILLOG_README.html" title="http://www.postfix.org/MAILLOG_README.html">http://www.postfix.org/MAILLOG_README.html</a>
avoids the logging dependency on system-effing-d.

Other possibilities are mis-configured SeLinux, AppArmor, and
the like, that prevent some Postfix daemons from writting to
the syslog socket.

Wietse

Re: Problem with logging

By ratatouille at 05/12/2019 - 15:37

Hello!

Wietse Venema < ... at porcupine dot org> schrieb am 12.05.19 um 15:24:01 Uhr:

It turned out $IMJournalStateFile imjournal.state in rsyslog.conf was the problem.
Commenting it out brought logging back after all logfiles where truncated to
some time yesterday after a restart of the server.

Meanwhile I upgraded to mail_version = 2.11.11 and will look if I can get
an rpm for version 3.4.

Thank you everybody!

Andreas

Re: Problem with logging

By Bill Cole at 05/12/2019 - 13:42

That is the process-id for the qmgr component of Postfix. The queue-ids
are the 10-character strings after the process information and before
the log details.

Disable verbose logging. It may actually be making the problem worse.

One common problem with logging on modern Linux distributions is the
rate limiting in systemd and rsyslog. The fact that you're only seeing
qmgr messages implies that there's something else involved, but rate
limiting may be a contributing factor. See the documentation for
systemd-journald and rsyslog and the configurations in
/etc/systemd/journald.conf and /etc/rsyslog.conf