- Previous message: Reinaldo Carvalho: "Re: When does postfix append a for <> in the Recieved: entry?"
- Maybe in reply to: Andreas Grimm: "Re: New document: STRESS_README"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
|
|
|
From: Victor Duchovni (no email)
Date: Thu Nov 01 2007 - 13:27:31 EDT
On Thu, Nov 01, 2007 at 10:10:30AM -0700, Andreas Grimm wrote:
> Hello,
>
> no, destinations are local files:
> destination mailinfo { file("/var/log/mail.info"); };
> destination mailwarn { file("/var/log/mail.warn"); };
> destination mailerr { file("/var/log/mail.err" fsync(yes)); };
> destination mail { file("/var/log/mail"); };
Why not just a single mail log file? How does "mail.info" differ from
"mail"? I am guessing you are writing each "info" (majority) log message
to disk twice. This is wasteful.
> Messages in the fifo should be dropped, thats right. Maybe the release
> comes from the simple restart of syslog-ng (cleaning up garbage?). It's
> confusing.
Either the log socket was actually unix-stream, or the sync flags were
wrong, or syslog-ng was unwell after running a long time, but that should
not happen.
Perhaps there were other settings in syslog-ng.conf that had not yet
taken effect? Also, you will lose some messages when you rotate
log files by renaming, and send SIGHUP to the log server. It rebinds
the /dev/log unix-domain socket, and messages are lost (briefly)
while the socket is rebuilt.
I avoid this, by not using fixed file names, and not sending SIGHUP.
destination mail {
file("/d/d1/log/raw/mail/$YEAR/$MONTH/$DAY/$HOUR"
template("$ISODATE $HOST $MSG\n") template_escape(no)
owner("root") group("log") perm(0640)
dir_owner("root") dir_group("log") dir_perm(02750)
create_dirs(yes));
};
These log files don't require external rotation, it is enough to just
delete sufficiently old ones periodically. We compress them first
(writing compressed data to a parallel directory tree) and move
sync the compressed files to a log aggregation server.
-- Viktor. Disclaimer: off-list followups get on-list replies or get ignored. Please do not ignore the "Reply-To" header. To unsubscribe from the postfix-users list, visit http://www.postfix.org/lists.html or click the link below: <mailto:?body=unsubscribe%20postfix-users> If my response solves your problem, the best way to thank me is to not send an "it worked, thanks" follow-up. If you must respond, please put "It worked, thanks" in the "Subject" so I can delete these quickly.
|
|
|