Postfix suddently stops logging on CentOS – rsyslog versus journalctl

Issue Encountered

Postfix works but doesn’t seem to log anymore.

tail -f /var/log/maillog shows nothing and nor does /var/log/mail.log. Sadly, this used to work.

Eventually you discover that Postfix is now logging to the journal. To see the “new” log:

journalctl -u postfix

To clear the log:

journalctl --vacuum-time=1d

To tail to log:

journalctl -u postfix -f

Migrate journalctl to rsyslog

I don’t like journalctl. When I’m busy and in a rush or when I have huge log files to work with, it’s already challenging. Trying to learn all the new flags required for journalctl just to work on Postfix is a nightmare. To me the solution is simply re-enable rsyslog.

Get rsyslog to log to /var/log/mail.log

These instructions worked on CentOS Stream but should be adaptable to both RedHat and Debian distributions.

dnf install rsyslog
mc -e /etc/rsyslog.d/mail.conf

Add this:

if $programname == 'postfix' or $syslogfacility-text == 'mail' then /var/log/mail.log
& stop

Then

system rsyslog restart

Reference

Share this article

Leave a Reply

Your email address will not be published. Required fields are marked *

Scroll to Top