rsyslog forwards auth.log sshd login records to a remote server but not mail authentication attempt records (dovecot:auth) or sudo command records. All mail.log records are forwarded as expected.

10-rsyslog.conf contains entries for both mail and auth logs files:

mail.* @@hostname:514
auth.* @@hostname:514

Noticed that postfix mail.log records appear in the /var/log/syslog file but not the auth.log records.

Is there a separate configuration setting to forward mail server authentication attempt/failure and sudo command records?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.