A week ago I set up a new miab server, and the experience with that has been great!
I’ve installed a digitalocean droplet, and other than installing a Splunk forwarder in the /opt directory, no changes have been made to the server other than what the setup script does and what can be done via the web ui.
I’m now working on some configurations to allow Splunk to monitor various miab log files, and so far this has also worked fine.
But now I’ve hit something odd. my miab server has both a “mail.log” and a “mail.log.1” file. The mail.log file contains most of the postfix entries as well as entries from opendkim, opendmarc, postgrey and spampd.
The mail.log.1 file is not an old log file, the way log rotate often renames files .1, .2 and so on, but it is actively being written to and contains all the imap log lines.
Looking in some of the relevant locations in the /etc directory, I haven’t yet found any reference to dovecot stuff being written to this mail.log.1 file.
Is this a “feature”? Having very little experience with miab, I do understand that the setup script writes a number of config files, and miab upgrades may overwrite any config changes undertaken by me, so I’m so far a little loth to try to change where dovecot writes its logs.
Is there anyone who can shed some light on this?
):