<div dir="ltr">Hello,<div><br></div><div>Is it possible that the *dovcot* application sends those logs via */dev/klog* ? Because in your configuration for that source the program is replaced with *kernel*.</div><div><br></div><div>I tried the *program* filter with freebsd 12 + syslog-ng 3.20.1 with the following configuration:</div><div><br></div><div>@version: 3.20<br></div><div><br></div><div>log {</div><div> source { internal(); };</div><div> if {</div><div> filter( program("syslog-ng"); };</div><div> rewrite { set(":)" value(".FILTER")); }; </div><div> }</div><div> else {</div><div> rewrite { set(":(" value(".FILTER")); };</div><div> }</div><div><br></div><div> destination { file("/dev/stdout" template("${.FILTER}\n")); };</div><div>};</div><div><br></div><div>starting with syslog-ng -F </div><div><br></div><div>The result seemed to be positive => :)</div><div><br></div><div><br></div><div>--</div><div>Kokan</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Mar 20, 2019 at 4:41 AM Stanislav <<a href="mailto:me@rooty.name" target="_blank">me@rooty.name</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Greetings,<br>
<br>
I'm getting this issue after my last package upgrade<br>
<br>
======================================<br>
Name : syslog-ng<br>
Version : 3.20.1<br>
Installed on : Mon Mar 11 23:27:29 2019 EET<br>
Origin : sysutils/syslog-ng<br>
Architecture : FreeBSD:12:amd64<br>
Prefix : /usr/local<br>
Categories : sysutils<br>
Licenses :<br>
Maintainer : cy@FreeBSD.org<br>
WWW : <a href="http://www.syslog-ng.org/" rel="noreferrer" target="_blank">http://www.syslog-ng.org/</a><br>
Comment : Powerful syslogd replacement<br>
Options :<br>
AMQP : off<br>
CURL : off<br>
DOCS : on<br>
GEOIP2 : off<br>
IPV6 : off<br>
JAVA : off<br>
JAVA_MOD : off<br>
JSON : on<br>
MONGO : off<br>
PYTHON : off<br>
REDIS : off<br>
RIEMANN : off<br>
SMTP : off<br>
SPOOF : off<br>
SQL : off<br>
TCP_WRAPPERS : off<br>
======================================<br>
<br>
<br>
<br>
I have following configuration:<br>
<br>
options { chain_hostnames(off); flush_lines(0); threaded(yes); <br>
create_dirs(yes); };<br>
source local {<br>
internal();<br>
unix-dgram( "/var/run/log" owner(root) group(wheel) <br>
perm(0666) );<br>
unix-dgram( "/var/run/logpriv" owner(root) group(wheel) <br>
perm(0600) );<br>
file( "/dev/klog" program_override("kernel") );<br>
};<br>
...<br>
destination all { file("/var/log/all.log"); };<br>
destination maillog_mda { file("/var/log/maillog-mda"); };<br>
...<br>
filter p_mail_imap { program("dovecot"); };<br>
...<br>
log { source(local); destination(all); };<br>
log { source(local); filter(p_mail_imap); destination(maillog_mda); };<br>
======================================<br>
# ps auxww|grep dovecot<br>
root 9648 0.0 0.1 13268 4196 - Is 00:46 0:00.04 <br>
/usr/local/sbin/dovecot -c /usr/local/etc/dovecot/dovecot.conf<br>
dovecot 9651 0.0 0.0 12724 3784 - I 00:46 0:00.01 <br>
anvil: [2 connections] (anvil)<br>
root 15259 0.0 0.0 12796 4168 - I 01:42 0:00.00 <br>
dovecot/log<br>
root 16126 0.0 0.1 13744 5020 - I 01:52 0:00.02 <br>
dovecot/config<br>
dovecot 16127 0.0 0.0 12724 4180 - I 01:52 0:00.01 <br>
stats: [3 connections] (stats)<br>
dovecot 17328 0.0 0.1 21284 12276 - I 02:05 0:00.01 <br>
auth: [0 wait, 0 passdb, 0 userdb] (auth)<br>
======================================<br>
# syslog-ng -s<br>
# echo $?<br>
0<br>
======================================<br>
<br>
I'm getting logs from dovecot program to /var/log/all.log but not <br>
/var/log/maillog-mda . As I mentioned before it was working on previous <br>
version of syslog-ng .<br>
Does anybody have this issue? Just me, lucky?<br>
<br>
<br>
<br>
______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
</blockquote></div>