Add logwatch maillog.conf file to support /var/log/mail/

[andrewlow]

Description

Create a new target/logwatch file tree.
Add a maillog.conf file that configures logwatch to look in the /var/log/mail/* path
Modify Dockerfile to pull from this target and place in the appropriate /etc/logwatch location

Fixes #2108

Type of change

• Improvement (non-breaking change that does improve existing functionality)

Checklist:

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation (README.md or the documentation under docs/)
• If necessary I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes

[casperklein]

Is the '*' a typo?

[andrewlow]

These come directly from the /usr/share/logwatch/default.conf/logfiles/maillog.conf file

To create the maillog.conf file that is in my PR is a modified version of the original.

[casperklein]

I understand. I would remove the comments on the top, because THIS file isn't maintained Kenneth 😉

I guess /usr/share/logwatch/default.conf/logfiles/maillog.conf is read first and extended/overwritten by the local changes made in /etc/logwatch/conf/logfiles/maillog.conf. That said, are the four lines at the end necessary (Line 26-30)?

[andrewlow]

Oops.. yeah - I should have removed the comment at the top.

I've now reviewed the doc on logwatch http://www.stellarcore.net/logwatch/tabs/docs/HOWTO-Customize-LogWatch.html - and better understand the way to customize it.

Very good review - thank you.

[casperklein]

I've tested it and it seems to work 👍 The daily logwatch mail went from ~60KB to 170KB.

[andrewlow]

FWIW - I've been running with this change as well for days now.

It is also possible to test this by shelling into the container

docker exec -it mailserver bash
logwatch --range Yesterday

If you have an existing mail server container that has been running for more than 1 day (because until you have a logrotate happen, the problem doesn't manifest itself) - then you can test things being broken.

Then by adding the /etc/logwatch/conf/logfiles/maillog.conf file - testing again, will result in a complete logwatch showing email that is in the /var/log/mail/mail.log.1 file.

[casperklein]

If you have an existing mail server container that has been running for more than 1 day

fyi: The (rotated) logs are kept during container restarts (if you use the default docker-compose.yml)

[andrewlow]

Agree - a new installation with no rotations (ever) would not have a /var/log/mail/mail.log.1 file.

I should have been more precise that you need to have data in a /var/log/mail/mail.log.1 file to test in a sane way.

[casperklein]

Would just an additional symlink also work?

/var/log/mail.log.1 -> /var/log/mail/mail.log.1

[andrewlow]

An additional symlink might work most of the time. Especially with the default 'Yesterday' logwatch parameter.

There are additional archive files which the maillog.conf file specifies, which would not be found.

# ls /var/log/mail
clamav.log       clamav.log.3.gz  freshclam.log.2.gz  mail.err.1   mail.info.2.gz  mail.log.1     mail.log.4.gz  mail.warn.2.gz
clamav.log.1     freshclam.log    freshclam.log.3.gz  mail.info    mail.info.3.gz  mail.log.2.gz  mail.warn      mail.warn.3.gz
clamav.log.2.gz  freshclam.log.1  mail.err            mail.info.1  mail.log        mail.log.3.gz  mail.warn.1

Adding target/logwatch opens up the possibility to add additional logwatch configurations.

[casperklein]

If nobody complains, I'll merge this in 1-2 days.

[georglauterbach]

LGTM

[georglauterbach]

#2109 should be merged first though @casperklein :)

[casperklein]

Haha. JUST thought the same. You were some seconds faster.

[georglauterbach]

This should be merged tomorrow, 11th August, when the pipelines for the v10.1.0 release finish successfully.

[wernerfred]

This should be merged tomorrow, 11th August, when the pipelines for the v10.1.0 release finish successfully.

assuming the fact that the major outage is fixed soon 🚀 https://www.githubstatus.com/

[georglauterbach]

This should be merged tomorrow, 11th August, when the pipelines for the v10.1.0 release finish successfully.

assuming the fact that the major outage is fixed soon 🚀 https://www.githubstatus.com/

All systems are operational again. I will merge this when all tests have passed.

[wernerfred]

@all-contributors add @andrewlow for code

[allcontributors]

@wernerfred

I've put up a pull request to add @andrewlow! 🎉

[andrewlow]

Thanks for all the work on this project - it's been a pleasure to participate.