Hello, I'm trying to send Dovecot logs to a Graylog server. To do this, I'd like to pass logs to rsyslog and rsyslog pass logs to remote Graylog server. I set in dovecot.conf : syslog_facility = local5.info I set in rsyslog.conf : local5.info @192.168.xxx.xxx:5555 Restarted services and it doesn't work.
I use nmap to test if port 5555 is opened and this port is open.
What missed I ?
Thanks
Nicolas
Hi Nicolas,
If you use 'logger' to test local5.info without Dovecot in the mix do you have success reaching your remote server?
Sent from my iPad.
On Feb 5, 2016, at 6:42 AM, Nicolas Fo nicocofo2@gmail.com wrote:
Hello, I'm trying to send Dovecot logs to a Graylog server. To do this, I'd like to pass logs to rsyslog and rsyslog pass logs to remote Graylog server. I set in dovecot.conf : syslog_facility = local5.info I set in rsyslog.conf : local5.info @192.168.xxx.xxx:5555 Restarted services and it doesn't work.
I use nmap to test if port 5555 is opened and this port is open.
What missed I ?
Thanks
Nicolas
Hello, thanks to take time for my problem. Just tested with this command from my mail server: logger -p local5.info "hello world" This message is well sent to my Graylog server. It seems it's a problem between Dovecot and rsyslog :/ Any ideas ? Thanks Nicolas
2016-02-05 16:52 GMT+01:00 Brad Guzules unixmfwic@mac.com:
Hi Nicolas,
If you use 'logger' to test local5.info without Dovecot in the mix do you have success reaching your remote server?
Sent from my iPad.
On Feb 5, 2016, at 6:42 AM, Nicolas Fo nicocofo2@gmail.com wrote:
Hello, I'm trying to send Dovecot logs to a Graylog server. To do this, I'd like to pass logs to rsyslog and rsyslog pass logs to remote Graylog server. I set in dovecot.conf : syslog_facility = local5.info I set in rsyslog.conf : local5.info @192.168.xxx.xxx:5555 Restarted services and it doesn't work.
I use nmap to test if port 5555 is opened and this port is open.
What missed I ?
Thanks
Nicolas
For information, my Dovecot version is 2.2.13, hop it can help. Thanks Nicolas
2016-02-05 19:59 GMT+01:00 Nicolas Fo nicocofo2@gmail.com:
Hello, thanks to take time for my problem. Just tested with this command from my mail server: logger -p local5.info "hello world" This message is well sent to my Graylog server. It seems it's a problem between Dovecot and rsyslog :/ Any ideas ? Thanks Nicolas
2016-02-05 16:52 GMT+01:00 Brad Guzules unixmfwic@mac.com:
Hi Nicolas,
If you use 'logger' to test local5.info without Dovecot in the mix do you have success reaching your remote server?
Sent from my iPad.
On Feb 5, 2016, at 6:42 AM, Nicolas Fo nicocofo2@gmail.com wrote:
Hello, I'm trying to send Dovecot logs to a Graylog server. To do this, I'd like to pass logs to rsyslog and rsyslog pass logs to remote Graylog server. I set in dovecot.conf : syslog_facility = local5.info I set in rsyslog.conf : local5.info @192.168.xxx.xxx:5555 Restarted services and it doesn't work.
I use nmap to test if port 5555 is opened and this port is open.
What missed I ?
Thanks
Nicolas
On 05/02/2016 9:42 AM, Nicolas Fo wrote:
I set in dovecot.conf : syslog_facility = local5.info
Try:
syslog_facility = local5
Just tested, same result :( Thanks Nicolas
2016-02-06 16:44 GMT+01:00 Oscar del Rio delrio@mie.utoronto.ca:
On 05/02/2016 9:42 AM, Nicolas Fo wrote:
I set in dovecot.conf : syslog_facility = local5.info
Try:
syslog_facility = local5
On Sat, Feb 06, 2016 at 07:22:33PM +0100, Nicolas Fo wrote:
Just tested, same result :(
It may be a silly question, but is one of log_path, info_log_path, or debug_log_path set to "syslog"? log_path defaults to it, so if you've changed that, the syslog service wouldn't be used. Dovecot's use of syslog is very vanilla, there's not much room for it to do much wrong.
Phil
2016-02-06 16:44 GMT+01:00 Oscar del Rio delrio@mie.utoronto.ca:
On 05/02/2016 9:42 AM, Nicolas Fo wrote:
I set in dovecot.conf : syslog_facility = local5.info
Try:
syslog_facility = local5
Great ! I was using both "log_path" and "syslog_facility" so "syslog_facility" didn't work. No I have in dovecot.conf : # Logging. Reference: http://wiki2.dovecot.org/Logging #log_path = /var/log/dovecot.log syslog_facility = local5
And in rsyslog.conf : local5.* @IP_RSYSLOG_SERVER:PORT local5.* -/var/log/dovecot.log
Thanks a lot Nicolas
2016-02-08 11:06 GMT+01:00 Phil Carmody phil@dovecot.fi:
On Sat, Feb 06, 2016 at 07:22:33PM +0100, Nicolas Fo wrote:
Just tested, same result :(
It may be a silly question, but is one of log_path, info_log_path, or debug_log_path set to "syslog"? log_path defaults to it, so if you've changed that, the syslog service wouldn't be used. Dovecot's use of syslog is very vanilla, there's not much room for it to do much wrong.
Phil
2016-02-06 16:44 GMT+01:00 Oscar del Rio delrio@mie.utoronto.ca:
On 05/02/2016 9:42 AM, Nicolas Fo wrote:
I set in dovecot.conf : syslog_facility = local5.info
Try:
syslog_facility = local5
participants (4)
-
Brad Guzules
-
Nicolas Fo
-
Oscar del Rio
-
Phil Carmody