Postfix logging to syslog even though it's excluded

Brett A.

3/9/24, 6:40 PM

Ubuntu 22.04 and postfix 3.6.4

Postfix config is set to use syslog_facility=mail, and I have modified /etc/rsyslog.d/50-default.conf to the following

*.*;mail,auth,authpriv.none     -/var/log/syslog
mail.warn                       /var/log/mail.err

Messages of warning and higher are correctly going to /var/log/mail.err, however all levels of mail facility messages are still going to syslog. Am I missing something?

411

1 + 3

postfix

syslog

rsyslog

smtpd

anx

3/9/24, 8:06 PM

Looks good to me, maybe missing a `systemctl restart rsyslogd`? Whats the point though? In Ubuntu 22.04 syslog is owned by systemd, rsyslog being demoted to just one way to process it. So why not have whatever application you want to read those file dynamically filter like `journalctl -o short-iso -u [email protected] -u example.service -u other.service -p 4` and generate precisely what you need, instead of rough selections stored in flat text files?

Brett A.

3/9/24, 9:18 PM

@anx this is a business requirement. these logs are being ingested into Splunk and stored into specific indexes, and the indexes have RBAC on them. The Splunk Universal Forwarder on the servers do not support filtering, otherwise I would do it before sending the logs to Splunk for processing. Hence, why I need them separated out from syslog.

Brett A.

3/10/24, 5:43 PM

@anx Nothing changed overnight except for the passage of time. Logging is working as expected today. Thanks for taking the time to respond!

Score:1

Server

M. Behrens

3/9/24, 11:06 PM

Try the following:

Insert mail.none for /var/log/syslog

For example:

*.info;mail.none;authpriv.none;cron.none                /var/log/syslog

And then log postfix messages into separate files:

# Log all the mail messages in one place.

mail.*               -/var/log/mail
mail.info            -/var/log/mail.info
mail.warning         -/var/log/mail.warn
mail.err             /var/log/mail.err

+ 0

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Postfix logging to syslog even though it's excluded

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.