Needing contents of /opt/zimbra/log/mailbox.log to send to remote syslog

[tsimmons]

Running Zimbra 8.6 on Ubuntu 12.04; We have already got /var/log/zimbra.log being routed to our central syslog server (10.x.x.x) using rsyslog:

Code: Select all

admin@zimbra-server:~$ cat /etc/rsyslog.d/60-zimbra.conf
local0.*                -/var/log/zimbra.log
local1.*                -/var/log/zimbra-stats.log
auth.*                  -/var/log/zimbra.log
mail.*                -/var/log/zimbra.log
mail.*                @10.x.x.x:514

The issue is we also need the information that is by default only logged to /opt/zimbra/log/mailbox.log (specifically, webmail actions like /soap/SendMsgRequest with remote IP) sent to our central syslog server as well. What is the best way to get these messages also sent to a remote syslog server?

[msquadrat]

You can enable logging to syslog via the attribute zimbraLogToSyslog. That will log to localhost using the local0 facility.

That said, you should really upgrade your version of Zimbra.

[tsimmons]

Thanks. Finally figured it out, we actually needed to syslog to a remote host, so (for anyone else looking to do this) I edited the two files:

• /opt/zimbra/conf/log4j.properties
  /opt/zimbra/conf/log4j.properties.in

First I created a custom appender, then I included our customer appender in the rootLogger:

Code: Select all

log4j.rootLogger=INFO,LOGFILE,CUSTOM

log4j.appender.CUSTOM=org.apache.log4j.net.SyslogAppender
log4j.appender.CUSTOM.SyslogHost=10.x.x.x
log4j.appender.CUSTOM.Facility=MAIL
log4j.appender.CUSTOM.layout=com.zimbra.common.util.ZimbraPatternLayout
log4j.appender.CUSTOM.layout.ConversionPattern=mailboxd: %-5p [%t] [%z] %c{1} - %m

[Blueberry]

Hi,

You should be aware that the SyslogAppender in Zimbra will truncate any messages over 1024 characters into multiple messages, unlike RollingFileAppender that logs to mailbox.log file.
For this reason, you may consider using the imfile module of rsyslog to send the exact logs recorded in the local mailbox.log file of your Zimbra store to your rsyslog distant server.

Cheers,
Blueberry.