RFC Change default logrotate settings for /var/mail/maillog

[casperklein]

Change default logrotate settings for /var/mail/maillog

• I would like to contribute to the project (code, documentation, advocacy, integration, ...)

Description

At the moment, the log files

• /var/log/mail/mail.info
• /var/log/mail/mail.warn
• /var/log/mail/mail.err

are rotated weekly, four times (see /etc/logrotate.d/rsyslog)

On the other hand, /var/log/mail/mail.log is rotated daily by default and only once. So there are only two days back in the logs.

To keep it uniform and avoid confusion about "missing" logs, I propose changing that also to an interval of 4.

So someone can set LOGROTATE_INTERVAL to weekly and got the same amount of logs for mail.log as for the other mail.* logs.

Even better would be, to change the default value of LOGROTATE_INTERVAL to weekly also.

Possible impacts

Changing default settings is always tricky. The only impact I see, is the increased usage of disk space for the additional logs.

[georglauterbach]

I like this. Streamlining logs is a good idea. Can you provide a PR? I'll review and merge it.

[casperklein]

What about changing the default value of LOGROTATE_INTERVAL to weekly?

[georglauterbach]

I can't see any negative impacts to be honest, therefore I see nothing wrong with it

[erik-wramner]

Hm, I responded to the PR before I noticed the issue. I generally don't like to change defaults but I do agree that the rotations should be streamlined.

As I recall the reason for keeping one file for mail.log is that it is processed by the reports. Keeping one file means that the previous day (or week or month) is available for the summary, but nothing more. If that is changed we need to double-check that the reports still produce the expected results.

When we are looking at this I have often wondered if mail.info really is useful. I certainly never use it. Perhaps it can be removed?

[casperklein]

Let's continue here for now ;-) Maybe @aendeavor can mark the PR as draft. I haven't found a way to do so.

Second, why do you change the number of retained log files and (more specifically) why do you want to keep 7 days, 5 weeks and 12 months respectively?

daily => rotate 7 times (1 week)
weekly => rotate 5 times (1 month)
monthly => rotate 12 times (1 year)

Initially I wanted to set it also to rotate 4 times. But I found it odd, when setting daily, to keep 4 days (why 4 and not the last week 7?) Same goes for weekly. Why 4 weeks and not keep the whole month (5)? That was the intention behind that.

Another thing that came to my mind: Why does LOGROTATE_INTERVAL only affect /var/log/mail.log and not the rest of the log files? I find it odd, to have the possibility, to change one rotate setting, but the rest is hard coded to 4?

On variable to manage them all equally would be best imho.

[erik-wramner]

It was before my time, but I think the original idea was that mail.log is used for the pflogsumm report on rotation. The other logs are just kept for manual analysis. That is most likely why they are treated differently. The pflogsumm uses /var/log/mail/mail.log.1 and that should be the most recently rotated file, so I think it is safe to change the rotate setting to keep additional copies. Your suggestion is perhaps as good as any. Not sure if we need to parameterize it, most installations are probably happy with the defaults.

[georglauterbach]

What's the current status here?

[casperklein]

For now, I only would change the rotate amount from 1 to 4 for var/log/mail/mail.log (then its aligned with the other logs) and leave the rest unchanged.

If you agree, I will change the PR accordingly.

[georglauterbach]

I very much agree:)

Tell me in the PR when you're ready and I'll merge it.

[casperklein]

Done with #1667