0

I'm running Ubuntu 16.04 with the packaged Dovecot for imap and Roundcube for its web interface. Everything's working dandy except I can't get Dovecot to stop logging imap logins and imap logouts to syslog.

/etc/rsyslog.d/50-defaults.conf:

#  Default rules for rsyslog.
#
#                       For more information see rsyslog.conf(5) and /etc/rsyslog.conf

#
# First some standard log files.  Log by facility.
#
auth,authpriv.*                 /var/log/auth.log
*.*;auth,authpriv.none          -/var/log/syslog
# cron.*                                /var/log/cron.log
#daemon.*                       -/var/log/daemon.log
kern.*                          -/var/log/kern.log
#lpr.*                          -/var/log/lpr.log
mail.*                          -/var/log/mail.log
& ~
#user.*                         -/var/log/user.log

#
# Logging for the mail system.  Split it up so that
# it is easy to write scripts to parse these files.
#
mail.info                       -/var/log/mail.info
mail.warn                       -/var/log/mail.warn
mail.err                        -/var/log/mail.err
mail.none                       /var/log/syslog

#
# Logging for INN news system.
#
news.crit                       /var/log/news/news.crit
news.err                        /var/log/news/news.err
news.notice                     -/var/log/news/news.notice

#
# Some "catch-all" log files.
#
#*.=debug;\
#       auth,authpriv.none;\
#       news.none;mail.none     -/var/log/debug
#*.=info;*.=notice;*.=warn;\
#       auth,authpriv.none;\
#       cron,daemon.none;\
#       mail,news.none          -/var/log/messages

#
# Emergencies are sent to everybody logged in.
#
*.emerg                                :omusrmsg:*

#
# I like to have messages displayed on the console, but only on a virtual
# console I usually leave idle.
#
#daemon,mail.*;\
#       news.=crit;news.=err;news.=notice;\
#       *.=debug;*.=info;\
#       *.=notice;*.=warn       /dev/tty8

# The named pipe /dev/xconsole is for the `xconsole' utility.  To use it,
# you must invoke `xconsole' with the `-file' option:
#
#    $ xconsole -file /dev/xconsole [...]
#
# NOTE: adjust the list below, or you'll go crazy if you have a reasonably
#      busy site..
#
# daemon.*;mail.*;\
daemon.*;
        news.err;\
        *.=debug;*.=info;\
        *.=notice;*.=warn       |/dev/xconsole

# Don't log Dovecot logins
:msg, contains, "imap-login" ~

/etc/rsyslog.conf:

#  /etc/rsyslog.conf    Configuration file for rsyslog.
#
#                       For more information see
#                       /usr/share/doc/rsyslog-doc/html/rsyslog_conf.html
#
#  Default logging rules can be found in /etc/rsyslog.d/50-default.conf


#################
#### MODULES ####
#################

module(load="imuxsock") # provides support for local system logging
module(load="imklog")   # provides kernel logging support
#module(load="immark")  # provides --MARK-- message capability

# provides UDP syslog reception
#module(load="imudp")
#input(type="imudp" port="514")

# provides TCP syslog reception
#module(load="imtcp")
#input(type="imtcp" port="514")

# Enable non-kernel facility klog messages
$KLogPermitNonKernelFacility on

###########################
#### GLOBAL DIRECTIVES ####
###########################

#
# Use traditional timestamp format.
# To enable high precision timestamps, comment out the following line.
#
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

# Filter duplicated messages
$RepeatedMsgReduction on

#
# Set the default permissions for all log files.
#
$FileOwner syslog
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
$PrivDropToUser syslog
$PrivDropToGroup syslog

#
# Where to place spool and state files
#
$WorkDirectory /var/spool/rsyslog

#
# Include all config files in /etc/rsyslog.d/
#
$IncludeConfig /etc/rsyslog.d/*.conf

Output of doveconf -n:

# 2.2.22 (fe789d2): /etc/dovecot/dovecot.conf
# Pigeonhole version 0.4.13 (7b14904)
# OS: Linux 4.4.0-112-generic x86_64 Ubuntu 16.04.3 LTS ext4
auth_mechanisms = plain login
log_path =
mail_location = maildir:/var/mail/vmail/%d/%n
mail_plugins = " quota"
mail_privileged_group = vmail
managesieve_notify_capability = mailto
managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext
namespace inbox {
  inbox = yes
  location =
  mailbox Drafts {
    auto = subscribe
    special_use = \Drafts
  }
  mailbox Junk {
    auto = subscribe
    special_use = \Junk
  }
  mailbox Sent {
    auto = subscribe
    special_use = \Sent
  }
  mailbox "Sent Messages" {
    special_use = \Sent
  }
  mailbox Trash {
    auto = subscribe
    special_use = \Trash
  }
  prefix =
}
passdb {
  args = /etc/dovecot/dovecot-sql.conf.ext
  driver = sql
}
plugin {
  quota = maildir:User quota
  quota_grace = 10%%
  quota_rule = *:storage=5G
  quota_rule2 = Trash:storage=+100M
  quota_status_overquota = 552 5.2.2 Mailbox is full
  sieve = ~/.dovecot.sieve
  sieve_after = /etc/dovecot/sieve/spamfilter.sieve
  sieve_dir = ~/sieve
}
postmaster_address = my@email.address.here
protocols = " imap lmtp sieve"
service auth {
  unix_listener /var/spool/postfix/private/auth {
    group = postfix
    mode = 0666
    user = postfix
  }
}
service imap-login {
  inet_listener imaps {
    port = 993
    ssl = yes
  }
}
service lmtp {
  unix_listener /var/spool/postfix/private/dovecot-lmtp {
    group = postfix
    mode = 0600
    user = postfix
  }
}
ssl = required
ssl_cert = </etc/letsencrypt/live/my.domain.name.here/fullchain.pem
ssl_key = </etc/letsencrypt/live/my.domain.name.here/privkey.pem
userdb {
  args = /etc/dovecot/dovecot-sql.conf.ext
  driver = sql
}
protocol lmtp {
  mail_plugins = " quota sieve"
}
protocol lda {
  info_log_path =
  log_path =
  mail_plugins = " quota sieve"
  postmaster_address = [my own e-mail address]
  syslog_facility = mail
}
protocol imap {
  info_log_path =
  log_path =
  mail_plugins = " quota imap_quota"
  syslog_facility = mail
}

# systemctl restart dovecot rsyslog doesn't help.

Things that get logged in both syslog and mail.log and which I want to have only logged in mail.log:

Feb 22 10:00:31 n40l dovecot: imap-login: Login: user=<my@email.address>, method=PLAIN, rip=::1, lip=::1, mpid=16286, secured, session=<eg2dRsllCusAAAAAAAAAAAAAAAAAAAAB>
Feb 22 10:00:31 n40l dovecot: imap(my@email.address): Logged out in=91 out=928

On a side note: cron is also still doggedly logging to syslog, can't get that to stop either. Not sure if that has the same cause.

Question: how do I make Dovecot log only to the mail log facility and not to syslog?

0

Create the full config by:

doveconf -a > fullconfig.txt

Look in it for an implicit logging options with = syslog as destination.

Change all unwanted to the = /dev/null.

  • root@n40l:~# doveconf -a | grep syslog only shows syslog_facility = mail three times. Checking by hand shows nothing that would suggest logging to syslog. – Forkbeard Feb 22 '18 at 13:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.