Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I know this has been asked a hundred times. But I've done a lot of Google searching without success. My question: I want to log every activity of my postfix server. Neither the default file /var/log/mail nor any other concerning mail or postfix exists.

  1. What's the exact string to put into the configuration file /etc/postfx/main.cf to enable logging?
  2. Where can i see which configuration file postfix uses? (according to my hint below)

Thanks for your answers.

Hint: I use postfix together with dovecot. I installed meta package some months ago.

Output for postconf -n:

    alias_database = hash:/etc/aliases
    alias_maps = hash:/etc/aliases
    append_dot_mydomain = no
    biff = no
    broken_sasl_auth_clients = yes
    config_directory = /etc/postfix
    home_mailbox = Maildir/
    inet_interfaces = all
    mailbox_command = /usr/lib/dovecot/deliver -c /etc/dovecot/conf.d/01-dovecot-postfix.conf -n -m "${EXTENSION}"
    mailbox_size_limit = 0
    mydestination = mydomain.de localhost
    myhostname = mydomain.de
    mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
    myorigin = /etc/mailname
    readme_directory = no
    recipient_delimiter = +
    smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
    smtp_use_tls = yes
    smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
    smtpd_recipient_restrictions = reject_unknown_sender_domain, reject_unknown_recipient_domain, reject_unauth_pipelining, permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
    smtpd_sasl_auth_enable = yes
    smtpd_sasl_authenticated_header = yes
    smtpd_sasl_local_domain = $myhostname
    smtpd_sasl_path = private/dovecot-auth
    smtpd_sasl_security_options = noanonymous
    smtpd_sasl_type = dovecot
    smtpd_sender_restrictions = reject_unknown_sender_domain
    smtpd_tls_auth_only = yes
    smtpd_tls_cert_file = /etc/ssl/certs/ssl-mail.pem
    smtpd_tls_key_file = /etc/ssl/private/ssl-mail.key
    smtpd_tls_mandatory_ciphers = medium
    smtpd_tls_mandatory_protocols = SSLv3, TLSv1
    smtpd_tls_received_header = yes
    smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
    smtpd_use_tls = yes
    tls_random_source = dev:/dev/urandom
    virtual_alias_maps = hash:/etc/postfix/virtual
    virtual_gid_maps = static:5000
    virtual_mailbox_base = /var/mail/vhosts
    virtual_mailbox_domains = mydomain2.de
    virtual_mailbox_maps = hash:/etc/postfix/vmailbox
    virtual_minimum_uid = 100
    virtual_uid_maps = static:5000

Output for /etc/syslog.conf

#  /etc/syslog.conf Configuration file for syslogd.
#
#           For more information see syslog.conf(5)
#           manpage.

#
# First some standard logfiles.  Log by facility.
#

auth,authpriv.*      -/var/log/auth.log
*.*;auth,authpriv.none;local0.none;local1.none      -/var/log/syslog
#cron.*          -/var/log/cron.log
daemon.*            -/var/log/daemon.log
kern.*              -/var/log/kern.log
lpr.*               -/var/log/lpr.log
user.*              -/var/log/user.log

#
# Logging for the mail system.  Split it up so that
# it is easy to write scripts to parse these files.
#

# Logging for INN news system
#
news.crit        -/var/log/news/news.crit
news.err         -/var/log/news/news.err
news.notice         -/var/log/news/news.notice

#
# Some `catch-all' logfiles.
#
*.=debug;\
    auth,authpriv.none;\
    news.none   -/var/log/debug
*.=info;*.=notice;*.=warning;\
    auth,authpriv.none;\
    cron,daemon.none;\
    mail,news.none      -/var/log/messages

#
# Emergencies are sent to everybody logged in.
#
*.emerg             *

#
# I like to have messages displayed on the console, but only on a virtual
# console I usually leave idle.
#
#daemon,mail.*;\
#   news.=crit;news.=err;news.=notice;\
#   *.=debug;*.=info;\
#   *.=notice;*.=warning    /dev/tty8

# The named pipe /dev/xconsole is for the `xconsole' utility.  To use it,
# you must invoke `xconsole' with the `-file' option:
# 
#    $ xconsole -file /dev/xconsole [...]
#
# NOTE: adjust the list below, or you'll go crazy if you have a reasonably
#      busy site..
#
daemon.*;mail.*;\
    news.err;\
    *.=debug;*.=info;\
    *.=notice;*.=warning    |/dev/xconsole
share|improve this question
    
Ubuntu's package of Postfix just logs to /var/log/mail.log by default. If that's not present or it does not log there, then please clarify what you changed to your system. Without providing such details of what you tried/found we can't really help you. Maybe it's as simple as a modified rsyslog configuration. We don't have access to your system and we can't see your screens, so we rely on what you provide in your question. And to print the current Postfix configuration, use postconf -n. –  gertvdijk Dec 23 '13 at 12:53
    
Please edit your question to include details. That's how this site works. Comments aren't fit for that. –  gertvdijk Dec 23 '13 at 13:36
    
Hi. I've added the output of postconf. I've changed nothing in the past. I just installed the meta package. Well, i could be possible that someone occupied the server and removed the logs :-D. There were a lot of messages send from this server the last days, which seem to be spam... –  pepperpark Dec 23 '13 at 13:41
    
If you suspect somebody just bluntly removed logfiles, then they might not be rotated properly anymore and a file descriptor is still open to an older (unlinked) logfile. Did you try to restart Postfix and rsyslog? –  gertvdijk Dec 23 '13 at 13:45
    
Yes, if've already restarted postfix a few times. I've also restarted the server some minutes ago. No changes. Files are still missing. As far as i know, all the active logs will be compressed after a period, so i think these are all the active ones: aptitude, auth, daemon, dovecot, dpkg, mysql, vsftpd. Well, if i didn't get any results today evening, i will make a backup and start the reinstall-process (provider function). And btw, i cannot restart rsyslog(d) -> unrecognized service. –  pepperpark Dec 23 '13 at 14:38

1 Answer 1

up vote 8 down vote accepted

They should be in /var/log/mail.log. However, it appears that your syslog facility configuration was changed by you (or your provider). Using the plain syslogd instead of rsyslogd is very much possible, but then you can expect things to work different to your expectation.

As already mentioned in the comments, by installing rsyslog, the files reappeared.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.