On Fri, 22 Nov 2002, Jeffrey Wheat wrote:
> Ok, so if I understand this correctly, I have to do something like
> this:
>
> mail.info;local4.none /var/log/maillog
> mail.notice;local4.none /var/log/maillog_rejects
> mail.alert;mail.err;mail.crit;local4.none /var/log/maillog_errors
>
> Which of doesn't work.
I am _not_ a syslog expert, and I can't remember details of how it
works, but reading what I wrote in the spec again:
> > The syslog 'facility' is set to LOG_MAIL, and the
> > program name to 'exim'.
> > The three log streams are mapped onto syslog priorities as follows:
> >
> > "mainlog" is mapped to LOG_INFO
> >
> > "rejectlog" is mapped to LOG_NOTICE
> >
> > "paniclog" is mapped to LOG_ALERT
suggests to me that maybe you should be configuring "exim.info" rather
than "mail.info". But without doing some research (for which I haven't
got time just at the moment) I can't be sure of that. I can't recall
what the difference between 'facility' and 'program name' is...
There isn't at present any way of stopping Exim from writing rejection
info to both the main and reject logs. The idea (when using separate
files) is
(1) You can easily scan the rejection data without having to wade
through the rest (and if you want to, you can delete it on a
shorter interval).
(2) Additional data can be given in the rejectlog (e.g. message
headers).
The syslog facility was added because some people wanted it, but as I
say, I'm no expert (nor a user), so I did the minimum and waited for
complaints. :-)
--
Philip Hazel University of Cambridge Computing Service,
ph10@??? Cambridge, England. Phone: +44 1223 334714.
