Robert's answer is a valid approach pending the size of your server networks etc.
on another note (because i run multiple servers etc)
I run a common syslog file across all servers which is what you appear to have now.
from there i like everything in one syslog because i am usually looking for something relative to a user which can occur anywhere. (imap, smtp, pop3, ssl etc)
that being said i wrote bash scripts that do stuff like
cat /var/log/syslog.log | grep $1
this allows everything from ALL servers going into one file for simplicity and then it gets seperated out when you go looking for something.
note that syslog can be programmed to divert to other servers in syslog.conf
## cat /etc/syslog.conf *.* /var/log/all.log *.* @10.228.0.6
10.228.0.6 is my central internal syslog capture server and all of my servers, routers, devices etc point to that and i go from there.
if you are having auth issues etc between dovecot & postfix this will show you everything related to a user, ip address etc.
Again its just a suggestion ... Logging is always relative to network setup more then anything else and situations vary easily.
I expanded this concept eventually into a database driven logger system in django, it is probably overkill for you but i am running 20+ servers and at the end of the day it was just easier to centralize it.
so
ssh 10.220.0.6 -q -tt /usr/home/syslog/log $1 $2 $3 $4 $5 $6 $7 $8 $9
or more spoecifically
log -t paul@hiscomputer.ca (-t was for today's date)
would give me all activity for my accounts
mail19 05-16 07:03:26 {smtphandler.py} [14475] (996976186) [14475] Header info data: 'hiscomputer.ca@em1.dereksloan.ca', ['paul@hiscomputer.ca'] ((While Handling File : /usr/home/postfix/tmp/936692CC6F0)) mail19 05-16 07:03:26 {smtphandler.py} [14475] (996976190) [14475] rSPF set : Received-SPF: Pass (sender SPF authorized) identity=mailfrom; client- ip=167.89.21.76; helo=o24.email.nationbuilder.com; envelope-from=bounces+14632821-e4fc-
paul=hiscomputer.ca@em1.dereksloan.ca; receiver=paul@hiscomputer.ca \n ((While Handling File :
/usr/home/postfix/tmp/936692CC6F0)) mail19 05-16 07:03:26 {smtphandler.py} [14475] (996976198) [14475] Checking for Spam SPF Conditions in rSPF : Received-SPF: Pass (sender SPF authorized) identity=mailfrom; client-ip=167.89.21.76; helo=o24.email.nationbuilder.com; envelope-
from=bounces+14632821-e4fc-paul=hiscomputer.ca@em1.dereksloan.ca; receiver=paul@hiscomputer.ca \n ((While Handling File : /usr/home/postfix/tmp/936692CC6F0)) mail19 05-16 07:03:26 {smtphandler.py} [14475] (996976200) [14475] processing TO: paul@hiscomputer.ca ((While Handling File :
/usr/home/postfix/tmp/936692CC6F0)) mail19 05-16 07:03:26 {smtphandler.py} [14475] (996976201) [14475] Checking if user paul@hiscomputer.ca has a mailbox ((While Handling File :
/usr/home/postfix/tmp/936692CC6F0)) mail19 05-16 07:03:26 {smtphandler.py} [14475] (996976202) [14475] SELECT * FROM email_users WHERE source = $$paul@hiscomputer.ca$$ ((While Handling File : /usr/home/postfix/tmp/936692CC6F0)) mail19 05-16 07:03:28 {MailScanner} [11525] (996976259) Delivery of nonspam: message 936692CC6F0.AF475 from bounces+14632821-e4fc-
paul=hiscomputer.ca@em1.dereksloan.ca to paul@hiscomputer.ca with subject WHO take over! mail19 05-16 07:03:42 {smtphandler.py} [14487] (996976373) [14487] Header info data: 'hiscomputer.ca@em1.dereksloan.ca', ['paul@hiscomputer.ca'] ((While Handling File : /usr/home/postfix/tmp/75A082CC6FE)) mail19 05-16 07:03:42 {smtphandler.py} [14487] (996976377) [14487] rSPF set : Received-SPF: Pass (sender SPF authorized) identity=mailfrom; client- ip=167.89.21.76; helo=o24.email.nationbuilder.com; envelope-from=bounces+14632821-e4fc-
paul=hiscomputer.ca@em1.dereksloan.ca; receiver=paul@hiscomputer.ca \n ((While Handling File :
/usr/home/postfix/tmp/75A082CC6FE)) mail19 05-16 07:03:42 {smtphandler.py} [14487] (996976385) [14487] Checking for Spam SPF Conditions in rSPF : Received-SPF: Pass (sender SPF authorized) identity=mailfrom; client-ip=167.89.21.76; helo=o24.email.nationbuilder.com; envelope-
from=bounces+14632821-e4fc-paul=hiscomputer.ca@em1.dereksloan.ca; receiver=paul@hiscomputer.ca \n ((While Handling File : /usr/home/postfix/tmp/75A082CC6FE)) mail19 05-16 07:03:42 {smtphandler.py} [14487] (996976387) [14487] processing TO: paul@hiscomputer.ca ((While Handling File :
/usr/home/postfix/tmp/75A082CC6FE)) mail19 05-16 07:03:42 {smtphandler.py} [14487] (996976388) [14487] Checking if user paul@hiscomputer.ca has a mailbox ((While Handling File :
/usr/home/postfix/tmp/75A082CC6FE)) mail19 05-16 07:03:42 {smtphandler.py} [14487] (996976389) [14487] SELECT * FROM email_users WHERE source = $$paul@hiscomputer.ca$$ ((While Handling File : /usr/home/postfix/tmp/75A082CC6FE)) mail19 05-16 07:03:42 {smtphandler.py} [14487] (996976395) [14487] Executing tmda : /usr/home/tmda/tmda/bin/rfilter -c paul@hiscomputer.ca -Z paul@hiscomputer.ca -Y "hiscomputer.ca@em1.dereksloan.ca" -X /usr/home/postfix/tmp/75A082CC6FE.txt ((While Handling File : /usr/home/postfix/tmp/75A082CC6FE)) mail19 05-16 07:03:42 {tmda} [14489] (996976399) To: paul@hiscomputer.ca mail19 05-16 07:03:42 {tmda} [14489] (996976404) Actn: OK (from-file /usr/home/tmda/users/paul@hiscomputer.ca/.tmda/lists/whitelist ok)(16751) mail19 05-16 07:03:42 {dovecot} [14512] (996976422) lda(paul@hiscomputer.ca)<14512><Tj6hHo4vgmKwOAAA0dxyZQ>: sieve:
msgid=62822f72a3ff3_3d1d125af5c60648@asgworker-qmb3-26.nbuild.prd.useast1.3dna.io.mail:
stored mail into
mailbox 'INBOX'
mail19 05-16 07:03:42 {postfix.local} [14511] (996976423) May 16
07:03:42 mail19 postfix/pipe[14511]: 5C7222CC701: to=paul@hiscomputer.ca,
relay=dovecot,
delay=0.22, delays=0.05/0.02/0/0.14, dsn=2.0.0, status=sent (delivered
via dovecot service)
mail19 05-16 07:23:15 {dovecot} [88258] (996998697)
imap-login: Login: user=paul@hiscomputer.ca, method=PLAIN,
rip=172.97.134.24,
lip=65.39.148.19,
mpid=15310
mail19 05-16 07:23:26 {dovecot} [88258] (996998740)
imap-login: Login: user=paul@hiscomputer.ca, method=PLAIN,
rip=172.97.134.24,
lip=65.39.148.19,
mpid=15312
mail19 05-16 07:23:34 {dovecot} [88258] (996998862)
imap-login: Login: user=paul@hiscomputer.ca, method=PLAIN,
rip=172.97.134.24,
lip=65.39.148.19,
mpid=15316
mail19 05-16 07:25:03 {dovecot} [88258] (997001016)
imap(paul@hiscomputer.ca)<15316><9yYOQR/fkOOsYYYY>: Disconnected: Logged
out in=178 out=4599
deleted=0
expunged=0 trashed=0 hdr_count=1 hdr_bytes=3112 body_count=0 body_bytes=0
mail19 05-16 07:25:03 {dovecot} [88258] (997001017)
imap(paul@hiscomputer.ca)<15312>: Disconnected: Logged
out in=256 out=188246
deleted=0
expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=1 body_bytes=186678
mail19 05-16 07:25:04 {dovecot} [88258] (997001025)
imap(paul@hiscomputer.ca)<15310>: Disconnected: Logged
out in=925 out=7369
deleted=0
expunged=0 trashed=0 hdr_count=1 hdr_bytes=388 body_count=0 body_bytes=0
mail19 05-16 07:38:00 {dovecot} [88258] (997013528)
imap-login: Login: user=paul@hiscomputer.ca, method=PLAIN,
rip=172.97.134.24,
lip=65.39.148.19,
mpid=15769
mail19 05-16 07:38:00 {dovecot} [88258] (997013529)
imap-login: Login: user=paul@hiscomputer.ca, method=PLAIN,
rip=172.97.134.24,
lip=65.39.148.19,
mpid=15770
mail19 05-16 07:38:01 {dovecot} [88258] (997013536)
imap(paul@hiscomputer.ca)<15769>: Disconnected: Logged
out in=194 out=20374
deleted=0
expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=1 body_bytes=17324
mail19 05-16 07:38:01 {dovecot} [88258] (997013537)
imap(paul@hiscomputer.ca)<15770><6+LNdB/foOOsYYYY>: Disconnected: Logged
out in=167 out=783
deleted=0
expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0
mail19 05-16 07:38:02 {dovecot} [88258] (997013540)
imap-login: Login: user=paul@hiscomputer.ca, method=PLAIN,
rip=172.97.134.24,
lip=65.39.148.19,
mpid=15772
mail19 05-16 07:38:15 {dovecot} [88258] (997013610)
imap(paul@hiscomputer.ca)<15772>: Disconnected: Logged
out in=166 out=12321
deleted=0
expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=1 body_bytes=11147
mail18 05-16 07:41:51 {dovecot} [51288] (997017656)
imap-login: Login: user=paul@hiscomputer.ca, method=PLAIN,
rip=172.97.231.82,
lip=65.39.148.18,
mpid=68491
mail18 05-16 07:41:57 {dovecot} [51288] (997017684)
imap-login: Login: user=paul@hiscomputer.ca, method=PLAIN,
rip=172.97.231.82,
lip=65.39.148.18,
mpid=68496
mail18 05-16 07:41:57 {dovecot} [51288] (997017685)
imap-login: Login: user=paul@hiscomputer.ca, method=PLAIN,
rip=172.97.231.82,
lip=65.39.148.18,
mpid=68497
peer1 05-16 07:49:25 {su} [36623] (997022563) HISTORY:
PID=36623 UID=0 log -t paul@hiscomputer.ca
Displayed 350 Records
for example.
Happy Monday !!! Thanks - paul
Paul Kudla
Scom.ca Internet Services http://www.scom.ca 004-1009 Byron Street South Whitby, Ontario - Canada L1N 4S3
Toronto 416.642.7266 Main 1.866.411.7266 Fax 1.888.892.7266
On 5/16/2022 5:58 AM, Cristiano Deana wrote:
Hi,
I have a mailserver with dovecot logging to syslog (by default, to /var/log/maillog) and my MTA (postfix) is doing the same. I use dovecot's services imap/pop3, auth and lmtp and now logs files are hard to read because I havve all together MTA and these services.
Is it possibile to have different log with different services?
Example: auth logging: /var/log/mail.auth delivery: /var/log/mail.delivery and so on
Thank you