1

I want to rotate my maillog, but I want to make sure the newly rotated log contains the last 2M lines from the previous log:

    # write the last 2M lines to a new log
    tail -n 2000000 /var/log/maillog > /var/log/maillog.new

    # move the existing log to datestamped backup
    datestamp=`date "+%Y%m%d"`
    mv /var/log/maillog /var/log/maillog.$datestamp

    # move the new log to normal log
    mv /var/log/maillog.new /var/log/maillog

    # tell sendmail to reload
    killall -HUP sendmail

This all works, except for the fact that sendmail continues to write to the backup log file "maillog.yyyymmdd" instead of the proper "maillog"!

What is the correct way to do this without having to stop sendmail first, rotate, then start again?

3 Answers 3

4

Usually maillog written by syslogd, not by sendmail itself, so you should send SIGHUP to syslogd

0
0

You can create your own log file

[admin@local ~]# killall sendmail
[admin@local ~]# touch /var/log/sendmail.log
[admin@local ~]# sendmail -bd -q15m >> /var/log/sendmail.log

And

[admin@local ~]# tail -f /var/log/sendmail.log

451 4.0.0 /fake/path/sendmail.cf: line 0: cannot open: No such file or directory
0

In the olde days you would simply (all of this as root) stop sendmail (/etc/init.d/sendmail stop or service sendmail stop), then you would move the /var/log/maillog to /var/log/maillog.1 and then you would create a new maillog with "touch /var/log/maillog" then restart sendmail (/etc/init.d/sendmail start or service sendmail start). This is fairly univeral across all *NIX flavors and distributions going back to the early 90's.

But today you are restarting sendmail, it's still trying to write to your old log file, even after you've moved it and will not write to the new file no matter what you set the user or permissions to. And if you make the mistake of deleting the maillog file it's using you can't see anything it's logging. So what do you do?

Linux has pioneered a newer way of doing things, sometimes for security and sometimes for automation. So they enhanced the system log process and some things don't work quite the same way, but close.

On a modern Linux (circa 2012 or newer you might have to do it like this):

1) stop sendmail

/etc/init.d/sendmail stop

or

service sendmail stop

2) move the logfile to a backup spot and create a new one

rm /var/log/maillog.2.gz
mv /var/log/maillog.1 /var/log/maillog.2
mv /var/log/maillog /var/log/maillog.1
touch /var/log/maillog

3) Set the ownership permissions on the /var/log/maillog file

chown root:root /var/log/maillog
chmod 600 /var/log/maillog

4) then TELL SYSLOGD TO RELOAD IT'S CONFIG, and this is the part that will save you if you are an old *NIX hack. If you don't do this, sendmail will not write to the new /var/log/maillog file you create NO MATTER WHAT YOU DO.

pkill -HUP rsyslog

5) NOW it's time to restart sendmail:

/etc/init.d/sendmail start

or

service sendmail start

And if you tail the /var/log/maillog file you should see output if mail is flowing.

I hope this save someone some time.

Thanks, David

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .