From: Victor Duchovni (Victor.DuchovniMorganStanley.com)
Date: Thu Nov 01 2007 - 12:27:31 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

On Thu, Nov 01, 2007 at 10:10:30AM -0700, Andreas Grimm wrote:

> Hello,
>
> no, destinations are local files:
> destination mailinfo { file("/var/log/mail.info"); };
> destination mailwarn { file("/var/log/mail.warn"); };
> destination mailerr { file("/var/log/mail.err" fsync(yes)); };
> destination mail { file("/var/log/mail"); };

Why not just a single mail log file? How does "mail.info" differ from
"mail"? I am guessing you are writing each "info" (majority) log message
to disk twice. This is wasteful.

> Messages in the fifo should be dropped, thats right. Maybe the release
> comes from the simple restart of syslog-ng (cleaning up garbage?). It's
> confusing.

Either the log socket was actually unix-stream, or the sync flags were
wrong, or syslog-ng was unwell after running a long time, but that should
not happen.

Perhaps there were other settings in syslog-ng.conf that had not yet
taken effect? Also, you will lose some messages when you rotate
log files by renaming, and send SIGHUP to the log server. It rebinds
the /dev/log unix-domain socket, and messages are lost (briefly)
while the socket is rebuilt.

I avoid this, by not using fixed file names, and not sending SIGHUP.

    destination mail {
        file("/d/d1/log/raw/mail/$YEAR/$MONTH/$DAY/$HOUR"
             template("$ISODATE $HOST $MSG\n") template_escape(no)
             owner("root") group("log") perm(0640)
             dir_owner("root") dir_group("log") dir_perm(02750)
             create_dirs(yes));
    };

These log files don't require external rotation, it is enough to just
delete sufficiently old ones periodically. We compress them first
(writing compressed data to a parallel directory tree) and move
sync the compressed files to a log aggregation server.

--
        Viktor.

Disclaimer: off-list followups get on-list replies or get ignored.
Please do not ignore the "Reply-To" header.

To unsubscribe from the postfix-users list, visit
http://www.postfix.org/lists.html or click the link below:
<mailto:majordomopostfix.org?body=unsubscribe%20postfix-users>

If my response solves your problem, the best way to thank me is to not
send an "it worked, thanks" follow-up. If you must respond, please put
"It worked, thanks" in the "Subject" so I can delete these quickly.

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]