Use different log files

[Robert Schetterer]

Am 16.05.2022 um 11:58 schrieb Cristiano Deana:
> Hi,
> 
> I have a mailserver with dovecot logging to syslog (by default, to 
> /var/log/maillog) and my MTA (postfix) is doing the same.
> I use dovecot's services imap/pop3, auth and lmtp and now logs files are 
> hard to read because I havve all together MTA and these services.
> 
> Is it possibile to have different log with different services?
> 
> Example:
> auth logging: /var/log/mail.auth
> delivery: /var/log/mail.delivery and so on
> 
> Thank you
> 

https://blog.sys4.de/xymon-dovecot-count-imap-pop3-logins-graph-central-rsyslog-server-ubuntu-lucid-en.html

use filter in syslog i.e

/etc/rsyslog.d/50-default.conf

     ...
     daemon.*;mail.*;\
     news.err;\
     *.=debug;*.=info;\
     *.=notice;*.=warn       |/dev/xconsole
     ...
     # dovecot
     :programname, isequal, "dovecot" /var/log/dovecot.log
     #pop3
     :msg, contains, "pop3" /var/log/dovecot-pop3.log
     #imap
     :msg, contains, "imap" /var/log/dovecot-imap.log
     ...

and dont forget to configure logrotate
too


-- 
[*] sys4 AG

https://sys4.de, +49 (89) 30 90 46 64
Schleißheimer Straße 26/MG,80333 München

Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263
Vorstand: Patrick Ben Koetter, Marc Schiffbauer, Wolfgang Stief
Aufsichtsratsvorsitzender: Florian Kirstein