Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have a vps running Ubuntu 10.04.4 LTS, and while trying to find a solution to a php problem, I've become aware of what looks like a problem with the syslog system - I'm not sure though.

The syslog.conf file looks like this:

    auth,authpriv.*      -/var/log/auth.log
*.*;auth,authpriv.none  -/var/log/syslog
#cron.*          -/var/log/cron.log
daemon.*            -/var/log/daemon.log
kern.*              -/var/log/kern.log
lpr.*               -/var/log/lpr.log
mail.*              -/opt/psa/var/log/maillog
user.*              -/var/log/user.log

# Logging for the mail system.  Split it up so that
# it is easy to write scripts to parse these files.
#           -/var/log/
mail.warning            -/var/log/mail.warn
mail.err         -/var/log/mail.err

# Logging for INN news system
news.crit        -/var/log/news/news.crit
news.err         -/var/log/news/news.err
news.notice         -/var/log/news/news.notice

# Some `catch-all' logfiles.
    news.none;mail.none -/var/log/debug
    mail,news.none      -/var/log/messages

# Emergencies are sent to everybody logged in.
*.emerg             *

# I like to have messages displayed on the console, but only on a virtual
# console I usually leave idle.
#   news.=crit;news.=err;news.=notice;\
#   *.=debug;*.=info;\
#   *.=notice;*.=warning    /dev/tty8

# The named pipe /dev/xconsole is for the `xconsole' utility.  To use it,
# you must invoke `xconsole' with the `-file' option:
#    $ xconsole -file /dev/xconsole [...]
# NOTE: adjust the list below, or you'll go crazy if you have a reasonably
#      busy site..
    *.=notice;*.=warning    |/dev/xconsole

And the /var/log/syslog file contains loads of entries like this:

    Jun 10 04:04:00 lvps109-104-93-171 postfix/qmgr[688]: 814E0676E997: removed
Jun 10 04:04:01 lvps109-104-93-171 postfix/smtpd[11105]: connect from[]

/var/log/, /var/log/mail.warn, & /var/log/mail.err are all empty despite the above configuration directing the relevant messages to them.

I've tried adding 'mail.* -/var/log/mail.log' to the conf file to see whether I can get the smtp & qmgr messages repeated there, but that log file remains empty too.

I tried changing '*.*;auth,authpriv.none -/var/log/syslog' to *.*;auth,authpriv.none;mail.none -/var/log/syslog to see whether I could stop any postfix messages going into /var/log/syslog, but they continue to go there.

I've been searching for ages to find the command I need to redirect these postfix messages to the mail.log file, but posts I've found only seem to mention the .info, .err, & .warn messages. As far as I have been able to find out , the syslog daemon should be directing them to the relevant files.

So my questions are: How do I redirect the postfix messages away from /var/log/syslog? Why aren't the .warn, .info, & .err messages going where they should be?

Any help gratefully received - Many thanks.

share|improve this question

I guess you're using rsyslog? You have to tell rsyslog to stop process the message after writing into the appropriate file. This can be done with & ~.

mail.*                          -/var/log/
& ~

Put these lines before the line that contains *.*.

Restart syslog when it's done.

share|improve this answer

This is what worked for me in Ubuntu 14.04.1 LTS to keep the mail items out of syslog:

*.*;mail,auth,authpriv.none     /var/log/syslog

And I split the mail logs into errors and non-errors with this, which also is working:

mail.debug;mail.!err    /var/log/mail.log
mail.err        /var/log/mail.err

Basically anything that's .debug level and above goes to mail.log, except for anything that's .err level and above which goes to the mail.err file.

The only thing I can think of that might have caused your mail log files to be empty would be having the - in front of the file path which I think has to do with not writing the log immediately.

Reference: 'Selectors' section of

share|improve this answer

This line:

*.*;auth,authpriv.none  -/var/log/syslog

means log every facility at every level to /var/log/syslog, with authpriv being the only exception. Obviously this includes mail.

You are also telling syslog to not sync the file immediately; this means that if you're not getting many email log lines, they may simply not get written immediately to the maillog files. The syslog file, however, will contain so many messages that it's likely to be written earlier.

Also, you need to restart the log service after you've made changes to the file. Usually this is done by simply sending a HUP to the PID of the syslogd process. When you've done that, check /var/log/syslog for any messages about lines in syslogd.conf that couldn't be parsed.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.