Mail Log has died!
 

Hi all.

Not to sure what’s gone wrong here. Last night at 4:03 AM log rotate did its thing, and archived the last weeks mail logs, or whatever it does every Sunday morning. But, for some strange reason, nothing has been logged to /var/log/maillog ever since –it’s just an empty file now.

I’ve restarted syslog, sendmail, and everything else I can think of, but still nothing. Another question would be, what would sendmail be logging to then? At first I thought it may have been some sort of security breech, but according to the file time on /var/log/maillog, this happened right after log rotate completed. Has anyone had this happen before? Any insight here would be appreciated, as I NEED my mail logs.

Much thanks,

Dave H

I don't know if you have checked these or not, but look at the following files:
/etc/log.d/logwatch.conf
/etc/syslog.conf
/etc/log.d/services/sendmail.conf
Make sure that the references are in place for sendmail. I would also check and make sure that all of the links are in place and not corrupted in the /etc/rc.d/rc0-6.d/"xxx"syslog (x's mean the different k or s numbers. You can do a "locate syslog" and find the correct path to these in your system. It may be that something got corrupted or overwritten when doing the rotate. One thing also occurred to me and I don't know the correctness of my thought, but is your /var/log/xxx files on a separate partition? It may be that the partition is full? Like I say, I am not sure how Linux responds in that particular instance. You might also do a ps aux from the command line and verify that the log.d daemon is running. Just a few thoughts. Good Luck!

Hey thanks Scooter.

You know what it was? I was messing with the settings for maillog in Webmin. Several weeks ago, I played around with the ‘facilities’ and ‘Priorities’ settings. For some stupid reason, I left the Priorities setting at “none.”

Everything continued to function as normal. What’s strange is that I’ve restarted the server several times since that point, and still… Mail logs continued to show up as normal.

It seems that the changes I made, (the messed up changes) suddenly took effect when log rotate ran early Sunday morning, thus it stopped logging mail activity. When I finally compared logwatch.conf with a backed up version, I noticed the mail logging option set to “none”-duh…

So there you have it. Despite the fact that syslog had been restarted several times after my messed up changes, they never took effect until log rotate ran, which is why I assumed there to be no problem with the configuration settings. Another 6-hours burned up ):

Thanks very much again for your suggestions,

You're quite welcome and good job on finding the fix. I have often found that I have been my biggest problem. usually something I did or did not do. Good luck in the future!