Re: mail log question
12.09.25, 14:05 +0200, Greg Wooledge:
> On Fri, Sep 12, 2025 at 13:24:37 +0200, Vincent Lefevre wrote:
>> On 2025-09-09 22:20:01 -0400, Greg Wooledge wrote:
>>> Or, if you don't care about those files and just want to read the systemd
>>> log files, you can use journalctl(1). Specifically, a command like
>>>
>>> journalctl -u postfix
>>>
>>> where "postfix" is the systemd service name in question, will show you
>>> the logs for that service.
>>
>> No, this is incorrect, at least on bookworm (it gives just a few logs):
>>
>> Sep 08 01:50:46 joooj systemd[1]: Starting postfix.service - Postfix Mail Transport Agent...
>> Sep 08 01:50:46 joooj systemd[1]: Finished postfix.service - Postfix Mail Transport Agent.
>>
>> Using a pattern
>>
>> journalctl -u postfix\*
>>
>> gives any log related to postfix, but this is terribly slow
>> (more than 3 minutes on my server!) and limited to postfix
>> (nothing about spamassassin, for instance).
>
> Welcome to systemd logging. It's really quite horrible.
>
> Spamassassin's log messages are written by a different service, so if
> you want to see those, you would use "journalctl -u spamassassin" or
> whatever its service name is.
>
> The other thing you might need to know is that you can get different
> levels of verbosity when you run the journalctl command as root vs.
> non-root. When you "only" got the Starting and Finished messages,
> I'm betting you ran the journalctl command as a non-root user. Try it
> as root.
>
> If you want all of the "mail-related" messages to be in a single
> file, install rsyslog and use the traditional human-readable log files
> under /var/log.
If you just want to see all "mail-related" messages with journalctl, you
can use
$ journalctl --facility mail
That doesn't help with journalctl's slowness if the journal has grown
big, of course.
--
Regards
mks
Reply to: