Tag Archive for: El Capitan

With OS X Server 5, Apple has further modified logging level and files for mail services. This setup is well thought out for occasional log peeking through Server.app, but can make it a bit cumbersome for troubleshooting since different log levels are written into separate log files, rather than a single one.

The most important logs for a mail server are:

/var/log/mail.log
/var/log/system.log
/Library/Logs/Mail/mail-info.log
/Library/Logs/Mail/mail-debug.log
/Library/Logs/Mail/amavis.log

These logs cover the SMTP, IMAP and SPAM Filter parts of mail services.

If you are curious, there are more logs here:

/Library/Logs/Mail/

When troubleshooting, most of the time we have to focus on SMTP and SPAM Filters. IMAP, which is provided by Dovecot, tends to give very few issues nowadays (while this wasn’t true in the pre 10.6 era where Cyrus was used).

So let’s focus on SMTP and SPAM Filters.

The SMTP logs are written into /var/log/mail.log while the SPAM Filter logs we usually need are written into /Library/Logs/Mail/amavis.log

The amount of information written into these logs depends on the logging level. The ones we care about are typically notice, info and debug

Most of the time you want your log levels to be at info. This gives you plenty of information for troubleshooting the most common issues. When running into real trouble, you might need even more detail which you get by setting the level to debug. Some object to keeping info on all the time as they claim that this generates lots of log entries and load on your server. Truth is, unless you are running mail services with hundreds of thousands of messages a day, this will never be an issue. Should you want to reduce the number of entries, you can set the log level to notice, but will have to compromise on the log detail you get.

Another factor is the time your log remains available before being rotated and archived or deleted. A good default setting is usually 1 day. However, most OS X Server mail servers aren’t so busy that you need to rotate daily, so setting it to 3-7 days gives you more detail to work with in the current log, rather than having to dig out archived logs. This is especially important if you suspect a breach and want to have a quick look at the past 48-72 hours.

Having said that, here is how to set what we discussed above:

sudo serveradmin settings mail:postfix:log_level = "info"
sudo serveradmin settings mail:postfix:spam_log_level = “info”
sudo serveradmin settings mail:imap:log_level = "info"
sudo serveradmin settings mail:postfix:log_rolling_days_enabled = yes 
sudo serveradmin settings mail:postfix:log_rolling_days = 3

To check your settings, you can for example issue:

sudo serveradmin settings mail:imap:log_level

Besides above log related commands, there are many more parameters that can be viewed or set via the command line. For an overview, issue:

sudo serveradmin settings mail

Be careful when unsure about changing a parameter and always make sure you have a working backup.

Another option is to merge SMTP and SPAM Filter information into one log. This of course comes down to personal preference. I like it, because I can follow the entire flow of an incoming or outgoing e-mail through SMTP and all connected filters, rather then having to peek into two separate log files.

To do so, edit¹
/Library/Server/Mail/Config/amavisd/amavisd.conf

and make sure the necessary parameters are set as follows:

$log_level = 3;
$DO_SYSLOG = 1;              # log via syslogd (preferred)
$syslog_facility = 'mail';

From now on, all SPAM Filter log entries will be written into /var/log/mail.log rather than /Library/Logs/Mail/amavis.log for easy troubleshooting.