Re: [EXIM] Exim logging by means of syslog(3)?

Top Page
Delete this message
Reply to this message
Author: Paul Mansfield
Date:  
To: Dom Mitchell
CC: Exim users mailing list
Subject: Re: [EXIM] Exim logging by means of syslog(3)?

On Wed, 8 Jul 1998, Dom Mitchell wrote:
> There is the additional problem, that for a busy machine, syslog is
> known to be an unreliable protocol and does drop some messages when it


the version of syslog with solaris allows you to have multiple entries
in syslog.conf for the same type (facility etc) of log message, which means
you can log the same thing to remote host(s) and to a file.

if Exim used different types of syslog message, the sys admin can set up
syslog to funnel messages to one place or not.

> Actually, we would need to keep the existing logging format anyway to
> make some sense of spool/msglog. You can't do that with plain syslog.


agreed, especially rejectlog, which is invaluable for detecting spam attacks.

I would definitely use syslog to log paniclog entries to a central log server,
but I'd also log to a local disk to ensure the total record was kept; I'd
probably not remotely log mainlog nor rejectlog, they're way too "noisy"...
Log files sizes for yesterday, on a machine delivering 40000 messages per day:

-rw-r-----   1 root     other    14728525 Jul  9 00:07 mainlog.1
-rw-r-----   1 root     other     628715 Jul  9 00:07 rejectlog.1


The paniclog doesn't get rotated... its quite short (except when when something
goes wrong!):
-rw-r--r--   1 root     other       8419 Jul  8 07:19 paniclog



Paul
----
P Mansfield, Senior SysAdmin PSINet, +44-1223-577577x2611/577611 fax:577600 
       Life begins at 70....mph : www.mansfield.co.uk/paulm/mcycle



--
*** Exim information can be found at http://www.exim.org/ ***