On Fri, 22 Nov 2002, Christopher Bodenstein wrote:
> > Nov 21 16:33:33 mail exim[50884]: 2002-11-21 16:33:33 H=to7.senderlist5682.com [12.158.236.70] F=<dneu9@???> rejected RCPT <user@???>: host is listed in sbl.spamhaus.org
> > Nov 21 16:33:33 mail exim[50884]: 2002-11-21 16:33:33 H=to7.senderlist5682.com [12.158.236.70] F=<dneu9@???> rejected RCPT <user@???>: host is listed in sbl.spamhaus.org
> >
> > Obviously this will make the logs much bigger than they need to be for starters.
> > Is there a way to correct this so that I only get one entry?
> >
> Check out your syslogd.conf file. You're probably logging both mail.log
> and mail.err to the same file, hence the duplicate entries. (just my
> guess ;)
Correct guess in general, details not quite... :-) As it says in the manual:
44.3 Logging to syslog
The use of syslog does not change what Exim logs or the format of its
messages, except in one respect. If "syslog_timestamp" is set false, the
timestamps on Exim's log lines are omitted when these lines are sent to
syslog. Apart from that, the same strings are written to syslog as to log
files. The syslog 'facility' is set to LOG_MAIL, and the program name to
'exim'. On systems that permit it (all except ULTRIX) the LOG_PID flag is set
so that the "syslog()" call adds the pid as well as the time and host name to
each line. The three log streams are mapped onto syslog priorities as follows:
"mainlog" is mapped to LOG_INFO
"rejectlog" is mapped to LOG_NOTICE
"paniclog" is mapped to LOG_ALERT
Many log lines are written to both "mainlog" and "rejectlog", so there will be
duplicates if these are routed by syslog to the same place.
--
Philip Hazel University of Cambridge Computing Service,
ph10@??? Cambridge, England. Phone: +44 1223 334714.
