At 7:04 AM -0400 5/11/07, Bruce Bodger imposed structure on a stream of electrons, yielding:
It appears as though dovecot doesn't like syslogd being restarted.
That's probably not it.
The whole point of syslog is for individual message sources (e.g. dovecot) to not have to worry about where the messages go.
This is actually at least partly a bug in the MacOS X syslog implementation. With 10.4, Apple decided that neither traditional BSD syslog or syslog-ng was what they wanted, so they reimplemented from the ground up and did a lousy job.
My system.log is rotated nightly followed by a pretty standard syslogd restart...
if [ -f /var/run/syslog.pid ]; then kill -HUP $(cat /var/run/syslog.pid | head -1);
That's not a restart, it is a 'hangup' signal that will make a normal syslogd reread the config file. The problem with that is that when you do it, Apple's syslogd completely stops logging. I'm not sure why that is, but I've been working around it since the 10.4 release and Apple has had a bug report for that long.
If you actually kill syslogd with a TERM or KILL signal it will be restarted by launchd and it should log properly.
It appears from that point on dovecot no longer writes to mail.log.
Dovecot was never writing to mail.log. Syslogd was, and it was broken.
Killing and restarting dovecot causes it to write to the log again.
That's a bit surprising, since if you are using syslog, the dovecot processes don't know anything about the specific log files that syslog is using. The implication of what you are seeing is that the breakage is between dovecot and syslogd, and that restarting dovecot fixes it.
--
Bill Cole
bill@scconsult.com