Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #274975 > unrolled thread

where is mail.log

Started byBitfox <hi@bitfox.ddns.net>
First post2024-11-29 01:10 +0100
Last post2024-12-03 11:20 +0100
Articles 9 on this page of 49 — 19 participants

Back to article view | Back to linux.debian.user

Contents

  where is mail.log Bitfox <hi@bitfox.ddns.net> - 2024-11-29 01:10 +0100
    Re: where is mail.log Greg Wooledge <greg@wooledge.org> - 2024-11-29 01:20 +0100
      Re: where is mail.log "Roy J. Tellason, Sr." <roy@rtellason.com> - 2024-11-29 21:20 +0100
        Re: where is mail.log Greg Wooledge <greg@wooledge.org> - 2024-11-29 21:30 +0100
          Re: where is mail.log gene heskett <gheskett@shentel.net> - 2024-11-29 22:30 +0100
          Re: where is mail.log Nicolas George <george@nsup.org> - 2024-11-30 14:40 +0100
            Re: where is mail.log "Roy J. Tellason, Sr." <roy@rtellason.com> - 2024-11-30 23:30 +0100
          Re: where is mail.log Max Nikulin <manikulin@gmail.com> - 2024-12-03 04:10 +0100
            Re: where is mail.log Greg Wooledge <greg@wooledge.org> - 2024-12-03 04:20 +0100
              Re: where is mail.log "Jonathan Dowland" <jmtd@debian.org> - 2024-12-03 10:30 +0100
        Re: where is mail.log Andy Smith <andy@strugglers.net> - 2024-11-29 21:50 +0100
        Re: where is mail.log pocket@homemail.com - 2024-11-29 22:40 +0100
          Re: where is mail.log <tomas@tuxteam.de> - 2024-11-30 07:40 +0100
            Re: where is mail.log Bitfox <bitfox@secubox.org> - 2024-11-30 13:40 +0100
              Re: where is mail.log Scott Andrews <pocket@homemail.com> - 2024-11-30 14:00 +0100
                Re: where is mail.log Richard Owlett <rowlett@access.net> - 2024-11-30 15:10 +0100
              Re: where is mail.log <tomas@tuxteam.de> - 2024-11-30 14:30 +0100
              Re: differences between sysvinit and systemd; was: where is mail.log Michael Kjörling <c9bc136c6063@ewoof.net> - 2024-11-30 14:30 +0100
                Re: differences between sysvinit and systemd; was: where is mail.log Greg Wooledge <greg@wooledge.org> - 2024-11-30 15:10 +0100
                  Re: differences between sysvinit and systemd Michael Kjörling <c9bc136c6063@ewoof.net> - 2024-11-30 16:50 +0100
              Re: where is mail.log Nicolas George <george@nsup.org> - 2024-11-30 14:50 +0100
            Re: where is mail.log pocket@homemail.com - 2024-11-30 13:40 +0100
              Re: where is mail.log Andy Smith <andy@strugglers.net> - 2024-11-30 18:00 +0100
                Re: where is mail.log Scott Andrews <pocket@homemail.com> - 2024-11-30 18:40 +0100
                  Re: where is mail.log <tomas@tuxteam.de> - 2024-11-30 19:00 +0100
                    Re: where is mail.log pocket@homemail.com - 2024-11-30 19:20 +0100
                      Re: where is mail.log Andy Smith <andy@strugglers.net> - 2024-11-30 19:30 +0100
                      Re: where is mail.log <tomas@tuxteam.de> - 2024-11-30 19:30 +0100
                      Re: where is mail.log Greg Wooledge <greg@wooledge.org> - 2024-11-30 19:40 +0100
                        Re: where is mail.log Andy Smith <andy@strugglers.net> - 2024-11-30 20:00 +0100
                          Re: where is mail.log <tomas@tuxteam.de> - 2024-11-30 20:20 +0100
                            Re: where is mail.log and the changing Linux ecosystem George at Clug <Clug@goproject.info> - 2024-12-01 01:10 +0100
                              Re: where is mail.log and the changing Linux ecosystem Greg Wooledge <greg@wooledge.org> - 2024-12-01 01:20 +0100
                                Re: where is mail.log and the changing Linux ecosystem George at Clug <Clug@goproject.info> - 2024-12-01 01:30 +0100
                                Re: where is mail.log and the changing Linux ecosystem <tomas@tuxteam.de> - 2024-12-01 07:20 +0100
                          Re: where is mail.log Jeffrey Walton <noloader@gmail.com> - 2024-12-02 17:30 +0100
                        Re: where is mail.log Scott Andrews <pocket@homemail.com> - 2024-11-30 20:00 +0100
                  Re: where is mail.log Andy Smith <andy@strugglers.net> - 2024-11-30 19:10 +0100
              Re: where is mail.log Anssi Saari <anssi.saari@debian-user.mail.kapsi.fi> - 2024-12-02 13:10 +0100
    Re: where is mail.log Dan Ritter <dsr@randomstring.org> - 2024-11-29 01:40 +0100
      Re: where is mail.log Greg Wooledge <greg@wooledge.org> - 2024-11-29 03:10 +0100
        Re: where is mail.log Bitfox <hi@bitfox.ddns.net> - 2024-11-29 05:10 +0100
        Re: where is mail.log Bitfox <hi@bitfox.ddns.net> - 2024-11-29 11:40 +0100
          Re: where is mail.log George at Clug <Clug@goproject.info> - 2024-11-30 13:30 +0100
    Re: where is mail.log George at Clug <Clug@goproject.info> - 2024-11-29 03:50 +0100
    Re: where is mail.log Michael <ml@hemathor.de> - 2024-12-02 12:50 +0100
      Re: where is mail.log Nicolas George <george@nsup.org> - 2024-12-02 13:10 +0100
        Re: where is mail.log Andy Smith <andy@strugglers.net> - 2024-12-02 16:10 +0100
          Re: where is mail.log Michael <ml@hemathor.de> - 2024-12-03 11:20 +0100

Page 3 of 3 — ← Prev page 1 2 [3]

#274978

FromGreg Wooledge <greg@wooledge.org>
Date2024-11-29 03:10 +0100
Message-ID<JNYCd-clrt-1@gated-at.bofh.it>
In reply to#274977
On Thu, Nov 28, 2024 at 19:13:12 -0500, Dan Ritter wrote:
> Bitfox wrote: 
> > My OS is debian 12 without GUI.
> > 
> > After I installed postifx by apt, I can't find the path to mail.log.
> > 
> > the log file in /var/log doesn't exist.
> > 
> > do you know where is my mail.log now?
> 
> by default, it's in /var/log.

No.  As of bookworm, rsyslog is no longer installed by default, and
there are no human-readable log files by default.

https://www.debian.org/releases/bookworm/amd64/release-notes/ch-information.en.html#changes-to-system-logging

[toc] | [prev] | [next] | [standalone]

#274981

FromBitfox <hi@bitfox.ddns.net>
Date2024-11-29 05:10 +0100
Message-ID<JO0ul-cmJz-1@gated-at.bofh.it>
In reply to#274978
On 2024-11-29 10:08, Greg Wooledge wrote:
> On Thu, Nov 28, 2024 at 19:13:12 -0500, Dan Ritter wrote:
>> Bitfox wrote:
>> > My OS is debian 12 without GUI.
>> >
>> > After I installed postifx by apt, I can't find the path to mail.log.
>> >
>> > the log file in /var/log doesn't exist.
>> >
>> > do you know where is my mail.log now?
>> 
>> by default, it's in /var/log.
> 
> No.  As of bookworm, rsyslog is no longer installed by default, and
> there are no human-readable log files by default.
> 
> https://www.debian.org/releases/bookworm/amd64/release-notes/ch-information.en.html#changes-to-system-logging

Thank you so much Greg.
I will install rsyslog instead.
Some tools like pflogsumm must use plain text logging.

[toc] | [prev] | [next] | [standalone]

#274985

FromBitfox <hi@bitfox.ddns.net>
Date2024-11-29 11:40 +0100
Message-ID<JO6zL-crRd-13@gated-at.bofh.it>
In reply to#274978
On 2024-11-29 10:08, Greg Wooledge wrote:
> On Thu, Nov 28, 2024 at 19:13:12 -0500, Dan Ritter wrote:
>> Bitfox wrote:
>> > My OS is debian 12 without GUI.
>> >
>> > After I installed postifx by apt, I can't find the path to mail.log.
>> >
>> > the log file in /var/log doesn't exist.
>> >
>> > do you know where is my mail.log now?
>> 
>> by default, it's in /var/log.
> 
> No.  As of bookworm, rsyslog is no longer installed by default, and
> there are no human-readable log files by default.
> 
> https://www.debian.org/releases/bookworm/amd64/release-notes/ch-information.en.html#changes-to-system-logging

Update:

following Greg's help, I run 'apt install rsyslog' and 'service postfix 
restart', now mail.log has been working.

2024-11-29T18:27:50.514443+08:00 mgw postfix/postfix-script[61549]: 
starting the Postfix mail system
2024-11-29T18:27:50.522266+08:00 mgw postfix/master[61551]: daemon 
started -- version 3.7.11, configuration /etc/postfix

Thanks a lot.

[toc] | [prev] | [next] | [standalone]

#275007

FromGeorge at Clug <Clug@goproject.info>
Date2024-11-30 13:30 +0100
Message-ID<JOuLL-cLkP-5@gated-at.bofh.it>
In reply to#274985

On Friday, 29-11-2024 at 21:30 Bitfox wrote:
> On 2024-11-29 10:08, Greg Wooledge wrote:
> > On Thu, Nov 28, 2024 at 19:13:12 -0500, Dan Ritter wrote:
> >> Bitfox wrote:
> >> > My OS is debian 12 without GUI.
> >> >
> >> > After I installed postifx by apt, I can't find the path to mail.log.
> >> >
> >> > the log file in /var/log doesn't exist.
> >> >
> >> > do you know where is my mail.log now?
> >> 
> >> by default, it's in /var/log.
> > 
> > No.  As of bookworm, rsyslog is no longer installed by default, and
> > there are no human-readable log files by default.
> > 
> > https://www.debian.org/releases/bookworm/amd64/release-notes/ch-information.en.html#changes-to-system-logging
> 
> Update:
> 
> following Greg's help, I run 'apt install rsyslog' and 'service postfix 
> restart', now mail.log has been working.
> 
> 2024-11-29T18:27:50.514443+08:00 mgw postfix/postfix-script[61549]: 
> starting the Postfix mail system
> 2024-11-29T18:27:50.522266+08:00 mgw postfix/master[61551]: daemon 
> started -- version 3.7.11, configuration /etc/postfix
> 
> Thanks a lot.

Thank you for your update.  

And thanks to others pointing out that rsyslog has been removed since Bookworm. Now I know that I will want to install rsyslog in Trixie servers once Trixie moves to production.

I am slowly learning journald and journalctl because as others have reported "it has been chosen as the way of the future".

As you said, for now there are still programs which still use rsyslog files.

I was pleased to learn "fail2ban works with journald" as I like to use fail2ban with postfix to block those who try to use postfix as a mail relay. 

I read that journald does not allow for forwarding to remote logging servers. Many people suggest using journald to collect the log entires, and then rsyslog to do send them to a remote centralised log server. However I also found  that systemd-journal-remote.service, systemd-journal-remote.socket, and systemd-journal-remote are available, and have been available for quite some time.
https://www.digitalocean.com/community/tutorials/how-to-centralize-logs-with-journald-on-debian-10

Has anyone implemented remote logging with systemd-journal-remote and can say how well this works?

Checking with Synaptic found a package called "systemd-journal-remote" :
This package provides tools for sending and receiving remote journal logs:
 * systemd-journal-remote
 * systemd-journal-upload
 * systemd-journal-gatewayd


George.





> 
>

[toc] | [prev] | [next] | [standalone]

#274979

FromGeorge at Clug <Clug@goproject.info>
Date2024-11-29 03:50 +0100
Message-ID<JNZeV-clDz-5@gated-at.bofh.it>
In reply to#274975
Hi,

I hope this helps. 

As other have said, there has been a move to let systemctl manage log files, and we now access the logs via journalctl.

That said, I did find this command returned some info:

# grep "postfix\|open" /var/log/syslog
Nov 29 02:20:35 mail postfix/postfix-script[1522]: starting the Postfix mail system
Nov 29 02:20:35 mail postfix/master[1524]: daemon started -- version 3.5.25, configuration /etc/postfix

But to manage postfix, I have been using these commands:

# journalctl -u postfix

or

# journalctl -u postfix@-.service

or if I have also implemented DKIM and DMARC, then

# journalctl -u postfix@-.service -u opendkim -u opendmarc

If in a terminal I want to monitor in real time I use the -f option:

# journalctl -f -u postfix@-.service -u opendkim -u opendmarc

I have seen the use of -t which allows the specification of multiple identifiers. 
journalctl -t postfix

journalctl -t postfix -t postfix/anvil -t postfix/bounce -t postfix/cleanup -t postfix_container -t postfix/error -t postfix/local -t postfix/master -t postfix/pickup -t postfix/postalias -t postfix/postfix-script -t postfix/proxymap -t postfix/qmgr -t postfix/scache -t postfix/sendmail -t postfix/smtp -t postfix/smtpd -t postfix/tlsmgr -t postfix/trivial-rewrite


https://man7.org/linux/man-pages/man1/journalctl.1.html

To show all fields emitted by a unit and about the unit, option
       -u/--unit= should be used.

       -t, --identifier=SYSLOG_IDENTIFIER
           Show messages for the specified syslog identifier
           SYSLOG_IDENTIFIER.

           This parameter can be specified multiple times.

Today I discovered this useful line ( read up on the options from "man journalctl" :

 journalctl --no-pager --quiet --identifier='postfix/smtp' --since='2022-10-30 00:00:00' --until='2024-12-06 23:59:59' --output='short'
 journalctl --no-pager --quiet --identifier='postfix/smtp' --since='2022-10-30 00:00:00' --until='2024-12-06 23:59:59' --output='short'

PAGER CONTROL OPTIONS         top

       The following options control page support:

       --no-pager
           Do not pipe output into a pager.

       -q, --quiet
           Suppresses all informational messages (i.e. "-- Journal
           begins at ...", "-- Reboot --"), any warning messages
           regarding inaccessible system journals when run as a normal
           user.

       -t, --identifier=SYSLOG_IDENTIFIER
           Show messages for the specified syslog identifier
           SYSLOG_IDENTIFIER.

FILTERING OPTIONS         top
The following options control how to filter journal records: -S, --since=, -U, --until= Start showing entries on or newer than the specified date, or on or older than the specified date, respectively.

       -o, --output=
           Controls the formatting of the journal entries that are
           shown. Takes one of the following options:

           short
               is the default and generates an output that is mostly
               identical to the formatting of classic syslog files,
               showing one line per journal entry.

               Added in version 206.

           short-full
               is very similar, but shows timestamps in the format the
               --since= and --until= options accept. Unlike the
               timestamp information shown in short output mode this
               mode includes weekday, year and timezone information in
               the output, and is locale-independent.

               Added in version 232.

George.

On Friday, 29-11-2024 at 11:07 Bitfox wrote:
> My OS is debian 12 without GUI.
> 
> After I installed postifx by apt, I can't find the path to mail.log.
> 
> the log file in /var/log doesn't exist.
> 
> do you know where is my mail.log now?
> 
> Thanks.
> 
>

[toc] | [prev] | [next] | [standalone]

#275126

FromMichael <ml@hemathor.de>
Date2024-12-02 12:50 +0100
Message-ID<JPd69-dcHw-3@gated-at.bofh.it>
In reply to#274975
since noone mentioned it:

  postfix has its own logging mechanism:

    https://www.postfix.org/MAILLOG_README.html

greetings...

[toc] | [prev] | [next] | [standalone]

#275128

FromNicolas George <george@nsup.org>
Date2024-12-02 13:10 +0100
Message-ID<JPdpv-dd3E-1@gated-at.bofh.it>
In reply to#275126
Michael (12024-12-02):
>  postfix has its own logging mechanism:

Making postfix part of the problem: different format for timestamps,
separate rotation and retention configuration, etc.

We do not want a different editor and build system for each programming
platform.

We do not want a different packaging system for each language.

We do not want a different logging system for each daemon.

We do not want square wheels reinvented everywhere.

Regards,

-- 
  Nicolas George

[toc] | [prev] | [next] | [standalone]

#275132

FromAndy Smith <andy@strugglers.net>
Date2024-12-02 16:10 +0100
Message-ID<JPgdI-deJF-13@gated-at.bofh.it>
In reply to#275128
Hello,

On Mon, Dec 02, 2024 at 01:08:52PM +0100, Nicolas George wrote:
> We do not want a different logging system for each daemon.

Unfortunately rather common practice though even before systemd-journald
of course: Exim, Apache HTTPD Server, HAProxy, … (some of these CAN be
configured to log to syslog, it's just not their default state)

I think in the past syslog was regarded as fairly low throughput and
potentially slow to complete. Also older syslog implementations could
only filter by facility and priority. So high throughput logging like for a web
server (access logs etc), which also often wanted to split by things like
vhost, were encouraged to do own logging.

Decent syslog implementations like rsyslog or syslog-ng have been fast
and full of features for ages though. Maybe app authors don't want to
assume their presence - and assume which one? App-specific logging does
have the benefit that the documentation for splitting the logs by some
attribute can come with the app.

I am in two minds whether the prevalence of journald will encourage or
discourage projects from growing their own logs. On the one hand it's
easy to display by unit, on the other hand I rarely see people doing
that and when there's a lot of logs they just complain.

Thanks,
Andy

-- 
https://bitfolk.com/ -- No-nonsense VPS hosting

[toc] | [prev] | [next] | [standalone]

#275178

FromMichael <ml@hemathor.de>
Date2024-12-03 11:20 +0100
Message-ID<JPyaB-dqLO-11@gated-at.bofh.it>
In reply to#275132
On Monday, December 2, 2024 4:04:12 PM CET, Andy Smith wrote:
>
> Unfortunately rather common practice though even before systemd-journald
> of course: Exim, Apache HTTPD Server, HAProxy, … (some of these CAN be
> configured to log to syslog, it's just not their default state)

iirc, and the referenced postfix page confirms that, postfix added its own 
logfile only because of the shortcomings of systemd's journald.

they never felt the need to add logging in the roughly 20+ years before 
that...

greetings...

[toc] | [prev] | [standalone]

Page 3 of 3 — ← Prev page 1 2 [3]

Back to top | Article view | linux.debian.user

csiph-web