Two postfix instances on same server, how to separate log

[SirWING]

Hi.

I'm running setup that looks like this:
postfix (tcp/25) -> Antivirus (tcp/10025) -> postfix (tcp/10026)
Mails are received by the first postfix instance forwarded to the antivirus application for scanning, which then forwards the mails to the second postfix instance for processing.

Both postfix instances log to /var/log/maillog, is it possible to get the two postfix instances to log to separate log files?

Any help would be appreciated.

 

[jkupski]

Postfix uses syslog, and I don't think you can change this behavior. However, you can change the syslog facility being used. You should be able to do this for an individual listener in master.cf by using, for example,

-o syslog_facility=local0

You can then edit your syslog configuration to direct local0 to whatever logfile you want.

If this does not work, or you do not want to muck with syslog, another idea would be to use

-o syslog_name pre-amavis

on your port 25 listener, and

-o syslog_name post-amavis

on your reinjection listener. In your current maillog, you see an entry like "postfix/smtpd" at the beginning of every line. With the above, you will instead see "pre-amavis/smtpd" and "post-amavis/smtpd" depending on which listener is creating the entry. You can then simply do something like

"cat /var/log/maillog | grep post-amavis > /tmp/post.out"

whenever you want to parse the logfile.

 

[SirWING]

Hi.

Thanks for the info.

I tried out with adding "-o syslog_name=post-av", but it didn't seem to do anything.
While googling I came upon the following discussion, which seems to indicate that you can't use syslog_name nor syslog_facility in master.cf, and that they are both global for all postfix processes.

http://archives.neohapsis.com/archives/postfix/2003-08/3376.html

The comment about two separate instances of postfix, I assume is referring to two postfix instances with separate sets of main.cf/master.cf files?

 

[jkupski]

Sorry that didn't work, I didn't realize those two parameters were limited in scope. I don't feel too bad about it though, because even Wietse apparently made the same mistake (see thread linked to below.)

There seems to be a possible workaround: using symlinks to smtpd. See

http://groups.google.com/group/list...slog_name+"master.cf"&rnum=8#4577813e2958be2f

and in particular post #6 for more information. They also mention syslog-ng but I have no experience there.

Hope it helps.