Subject: Re: Bug#289892: amavisd-new: Actually, use this logrotate config instead

From: Brian May <[email-masked]>
Date: Wed, 19 Jan 2005 09:12:44 +1100

severity 258387 wishlist
merge 258387 289892
thanks

Hello,

As explained in bug 289892, (see <URL:http://bugs.debian.org/289892>),
amavisd-new doesn't create a amavis.log file in the default debian
installation, and rotating a file that doesn't exist seems silly.

If you disagree please let me know why.

Thanks.
-- 
Brian May <[email-masked]>

---

From: Micah Anderson <[email-masked]>
Date: Wed, 19 Jan 2005 18:47:56 -0600

On Sat, 31 Jul 2004, Brian May wrote:

>Sorry, but I believe this situation is very specific to your
>particular setup. As such, I feel it is your responsibility rotate the
>required log files. I don't want to restart the amavis process
>regularly if I can avoid it, this is one of the benefits of using
>syslog.

I don't believe that this situation is that specific, I too separate
the amavis logs out and do so on quite a number of installations.
Other people I know who use amavis prefer to do it this way as well,
especially with large mail installations.

It is not required to restart amavis to rotate the logfile.

>The way it is now, all mail logs on my setup go to
>/var/log/mail.log. This means that there is only one file to consult
>if any mail goes missing.

This works great on a machine that doesn't do much mail processing,
but if you run a medium to large mail installation (we have over
10,000 users for email, and over a half-million subscribers to mailing
lists using amavisd-new) you desperately want to separate out your
logfiles so that you can identify problems and deal with them in a
rapid manner. With amavis logging to /var/log/mail.log, courier
logging to /var/log/mail.log, postfix logging to /var/log/mail.log,
etc. you can imagine what its like when hundreds of thousands of
messages are being sent in and out of a machine every minute, its
basically impossible to sort through this information if everything is
blowing their noise into the same logfile all at the same time. If I
didn't separate all the different logging elements that were being
pumped into /var/log/mail.log I would not have been able to identify
amavis specific errors on upgrades, or postfix specific errors when
that subsystem is upgraded, etc.

Additionally, incredibly large logfiles are very difficult to process.
I appreciate trying to keep the system from getting too many logfiles,
however there are really good reasons why things like apache sort the
error logs from the access logs, and one of them isn't because its
fun. If you monitor your amavisd filtering statistics, with either a
logwatch program, a alert system, or a statistical analysis graphing
program, chewing through /var/log/mail.log puts an enormously larger
burden on the system than if amavisd has its own logfile.

> installation, and rotating a file that doesn't exist seems silly.

I agree, I had changed this in my amavisd config file and had
forgotten that it wasn't the default. However, I believe this *should*
be the default, not just because thats how I like it, or the original
bug submitter likes it, but because its a really good idea.

> If you disagree please let me know why.

See above :)

> Thanks.

Thanks for considering this!

Micah