On 2024-12-16 01:16, Wietse Venema via Postfix-users wrote:
>>
>> All the processes of a service share single CGroup, so there's no ambiguity.
>
> You read half my question and stopped mid-way. Please extend
> your attention san.
Actually I've answered it all, but might elaborate.
> Again, what about the logging from NON-DAEMON Postfix processes
> such as sendmail, postdrop, postqueue, and so on?
They belong to their calling service. Therefore if I run sendmail from
the shell, it belongs to my user's slice. If postdrop is run from
mimedefang-multiplexor.service, it's accounted to mimedefang, not
postfix.service.
Excessive logging by some user won't impact another service.
# echo | postdrop
protocolpostdrop_protocolqueue_id03AD4840693postdrop: warning: stdin:
unexpected EOF reading length, record type 10
postdrop: fatal: uid=0: malformed input
# journalctl -o json-pretty --since -2m
{
"_SYSTEMD_SESSION" : "c219",
"_SYSTEMD_UNIT" : "session-c219.scope",
"_BOOT_ID" : "65d6529c8a1f498e83c912fd0caff7b9",
"_SYSTEMD_SLICE" : "user-0.slice",
"SYSLOG_TIMESTAMP" : "Dec 16 01:59:05 ",
"_SYSTEMD_CGROUP" : "/user.slice/user-0.slice/session-c219.scope",
"MESSAGE" : "warning: stdin: unexpected EOF reading length, record type
10",
"SYSLOG_FACILITY" : "2",
"__MONOTONIC_TIMESTAMP" : "10491363025175",
"__REALTIME_TIMESTAMP" : "1734310745015257",
"_UID" : "0",
"_MACHINE_ID" : "XXX",
"_SOURCE_REALTIME_TIMESTAMP" : "1734310745015188",
"_GID" : "0",
"_HOSTNAME" : "mail-server",
"SYSLOG_IDENTIFIER" : "postfix/postdrop",
"_SYSTEMD_USER_SLICE" : "-.slice",
"_SYSTEMD_OWNER_UID" : "0",
"_CAP_EFFECTIVE" : "fdecafff",
"_PID" : "37619",
"__CURSOR" :
"s=4de95f5241624f63b0594c7c4c7c40af;i=9eb323;b=65d6529c8a1f498e83c912fd0caff7b9;m=98ab5f76117;t=62958afe303d9;x=3f5ee95c2953fc93",
"_CMDLINE" : "postdrop",
"_EXE" : "/usr/sbin/postdrop",
"_TRANSPORT" : "syslog",
"PRIORITY" : "4",
"_RUNTIME_SCOPE" : "system",
"_COMM" : "postdrop",
"SYSLOG_PID" : "37619",
"_SYSTEMD_INVOCATION_ID" : "fc07626bfd5940f0abd6f97a5bd91e23"
}
{
"_PID" : "37619",
"_RUNTIME_SCOPE" : "system",
"_CMDLINE" : "postdrop",
"_CAP_EFFECTIVE" : "fdecafff",
"_SYSTEMD_UNIT" : "session-c219.scope",
"_SYSTEMD_OWNER_UID" : "0",
"_GID" : "0",
"SYSLOG_TIMESTAMP" : "Dec 16 01:59:05 ",
"_SOURCE_REALTIME_TIMESTAMP" : "1734310745015201",
"_SYSTEMD_USER_SLICE" : "-.slice",
"SYSLOG_FACILITY" : "2",
"__MONOTONIC_TIMESTAMP" : "10491363026004",
"SYSLOG_PID" : "37619",
"_SYSTEMD_CGROUP" : "/user.slice/user-0.slice/session-c219.scope",
"MESSAGE" : "fatal: uid=0: malformed input",
"SYSLOG_IDENTIFIER" : "postfix/postdrop",
"_UID" : "0",
"_COMM" : "postdrop",
"_SYSTEMD_SLICE" : "user-0.slice",
"_SYSTEMD_SESSION" : "c219",
"_MACHINE_ID" : "XXX",
"_BOOT_ID" : "65d6529c8a1f498e83c912fd0caff7b9",
"_SYSTEMD_INVOCATION_ID" : "fc07626bfd5940f0abd6f97a5bd91e23",
"_TRANSPORT" : "syslog",
"PRIORITY" : "2",
"__CURSOR" :
"s=4de95f5241624f63b0594c7c4c7c40af;i=9eb324;b=65d6529c8a1f498e83c912fd0caff7b9;m=98ab5f76454;t=62958afe30717;x=1b041f67bc56d05e",
"__REALTIME_TIMESTAMP" : "1734310745016087",
"_EXE" : "/usr/sbin/postdrop",
"_HOSTNAME" : "mail-server"
}
# journalctl -u session-c219.scope
Dec 16 01:55:24 systemd[37553]: pam_unix(login:session): session opened for
user root(uid=0) by (uid=0)
Dec 16 01:59:05 postfix/postdrop[37619]: warning: stdin: unexpected EOF reading
length, record type 10
Dec 16 01:59:05 postfix/postdrop[37619]: fatal: uid=0: malformed input
# journalctl -u postfix | grep fatal
#
# journalctl --identifier=postfix/postdrop
Dec 16 01:59:05 postfix/postdrop[37619]: warning: stdin: unexpected EOF reading
length, record type 10
Dec 16 01:59:05 postfix/postdrop[37619]: fatal: uid=0: malformed input
# journalctl --priority=2
Dec 16 01:59:05 postfix/postdrop[37619]: fatal: uid=0: malformed input
# journalctl _EXE=/usr/sbin/postdrop
Dec 16 01:59:05 postfix/postdrop[37619]: warning: stdin: unexpected EOF reading
length, record type 10
Dec 16 01:59:05 postfix/postdrop[37619]: fatal: uid=0: malformed input
Since v256 you could also exclude by syslog identifier:
# journalctl -u postfix.service -T postfix/postscreen
_______________________________________________
Postfix-users mailing list -- [email protected]
To unsubscribe send an email to [email protected]
