[Rspamd-Users] syslog and missing log messages

[Michael Grimm]

Gerald Galster <list+rspamd at gcore.biz> wrote:

>> My local.d/loggin.inc is as follows:
>> 
>> type = "syslog";
>> facility = "mail";
>> level = "info";     # log all non-debug messages
> 
> I have the same config (but running linux and systemd-journald) and I get
> 
>    SYSLOG_FACILITY=2  (mail system)
>    PRIORITY=7         (debug)
>    MESSAGE=<c299fd>; proxy; rspamd_task_write_log: id: ....
> 
> So it basically works.

Good to know.

> Does your syslog ignore debug for mail?

Bingo! Many, many kudos!

I had had in my over 20+ years grown /etc/syslog.conf:

	*.info;console.notice;authpriv.none;kern.debug  /var/log/messages
	mail.info                                       /var/log/maillog

So, neither ...

> What happens if you change the facility to something else that
> might not have any defaults associated with it, like
> 
>    # local.d/logging.inc
>    facility = "local5";

… local5.debug nor mail.debug ended in either /var/log/messages or /var/log/maillog :-(

Thus, it is time for a Frühjahrsputz [1] in my /etc/syslog


But there is one more puzzle remaining, namely why my local.d/loggin.inc …

	type = "syslog";
	facility = "mail";
	level = "info";     # log all non-debug messages

… will send mail.*debug* messages to my host's syslog in the first place? 

See:
	Apr 11 20:58:50 <mail.debug> mail rspamd[16488]: <9f588c>; proxy; rspamd_task_write_log: id: <xxx.tld>, qid: <yyy>, ip: ...


Thank you very much for your eye-opener, very much appreciated.

Regards,
Michael


[1] I tend to translate that to "spring-clean" ;-)