/var/log/zimbra.log is empty: why?

[Dude]

I installed the zimbra development version 3.0/M3 for Suse10

All went well, no errors in zmsetup.log.
Zimbra service Mysql/postfix etc running.
Zimbra admin is running on port 7071, the client op port 7070

So far so good.

My problem: I can see messages arriving in /opt/zimbra/store but
they are not visible in my client.

I checked the /var/log/zimbra.log but it stays empty.
Any reason why, it doesn't help me debugging!

[marcmac]

syslog.conf may be incorrectly configured. /var/log/maillog will probably have postfix logs

[Dude]

Originally Posted by marcmac

syslog.conf may be incorrectly configured. /var/log/maillog will probably have postfix logs

So back home again, time to check the settings:

This the current content of /etc/syslog.conf:
local0.* -/var/log/zimbra.log
mail.* -/var/log/zimbra.log

This looks like the default from zimbra, is it complete?

[Dude]

OK, receiving mail problem resolved.

Setting the dns check off worked.

But the zimbra messages get scattered around
/var/log/mail /var/log/messages etc

See my post about my syslog.conf: what is wrong?

[marcmac]

Have you tried restarting syslogd? Does /var/log/zimbra.log exist? Have you read the syslog man page?

[Dude]

Originally Posted by marcmac

Have you tried restarting syslogd? Does /var/log/zimbra.log exist? Have you read the syslog man page?

1. Executed once more:
/etc/init.d/syslog restart:

2. zmcontrol stop and then start

3. ls -la /var/log/zimbra.log:
-rw-r--r-- 1 zimbra zimbra 0 Jan 19 06:20 /var/log/zimbra.log

Still no entries.
I was hoping to skip the manpage step.
But if it is needed, is this Suse 10 related or just a config issue?

[marcmac]

my box (not suse) has the logger command:

logger -p mail.err "test message"
will syslog a message at the mail.err level.

Could be a suse issue - try dropping the '-' before the filenames in syslog.conf - could be they don't support async syslog (which would be sub-optimal, imho)

[Dude]

Puzzling:

1. logger -p mail.err "test"
Works! message shows up in the /var/log/mail.err

2. logger -p zimbra.log "test message"
Results in the message
logger: unknown facility name: zimbra.

**Edit**
Found the source of the problem:
syslog.conf is not used at all!
syslog-ng is installed by default

Will do a manual study and come back or switch to syslog

thx for the suggestions!

[marcmac]

zimbra isn't a legal facility. We log under two facilities: mail, and LOCAL0.

Is zimbra running? Does anything show up in /var/log/maillog, postfix related? Could just be local0 that's choking.

[Dude]

For those who will encounter this problem, this what I have changed to get logging in zimbra.log for syslog-ng (used a.o. in SuSe 10):

1. edit /etc/syslog-ng/syslog-ng.conf
2. change the following line:

destination mail { file("/var/log/zimbra.log"); };
    log { source(src); filter(f_mail); destination(mail); };

3. Add these lines at the bottom:

# Zimbra
destination local0 { file("/var/log/zimbra.log"); };
log { source(src); destination(local0); };

Note: could be that I have to do some fine-tuning but it works for now