Maybe someone here knows how the ownership of these files for Dovecot needs to be in order to work, as various distributions of Dovecot packages seem
to use different users:
I'd like Dovecot not to log into syslog, but to dedicated files. Therefore I've created the directory /var/log/dovecot and told dovecot in 10-logging.conf to log info, debug and error messages to separate files.
But I get error messages from postfix (weird):
May 13 20:55:37 mail postfix/local[2824184]: 95BCF1000A9: to=<user@domain.de>,
relay=local, delay=3.2, delays=1.9/0.29/0/1.1, dsn=4.3.0, status=deferred (temporary failure. Command output: lda(user): Error: net_connect_unix(/run/dovecot/stats-writer) failed: Permission denied Can't open log file /var/log/dovecot/error.log: Permission denied )
This is the content of /var/log/dovecot:
-rw-r--r-- 1 dovecot dovecot 0 13. Mai 20:50 debug.log
-rw-r--r-- 1 dovecot dovecot 880 13. Mai 21:21 error.log
-rw-r--r-- 1 dovecot dovecot 40K 13. Mai 21:20 info.log
So why is Dovecot complaining?
I only see processes owned by root, dovecot,
dovenull and user processes of dovecot. And dovenull seems to be not
relevant for this.
Best
Richard
May 13 20:55:37 mail postfix/local[2824184]: 95BCF1000A9: to=<user@domain.de>,
relay=local, delay=3.2, delays=1.9/0.29/0/1.1, dsn=4.3.0, status=deferred (temporary failure. Command output: lda(user): Error: net_connect_unix(/run/dovecot/stats-writer) failed: Permission denied Can't open log file /var/log/dovecot/error.log: Permission denied )
This is the content of /var/log/dovecot:
-rw-r--r-- 1 dovecot dovecot 0 13. Mai 20:50 debug.log
-rw-r--r-- 1 dovecot dovecot 880 13. Mai 21:21 error.log
-rw-r--r-- 1 dovecot dovecot 40K 13. Mai 21:20 info.log
Maybe someone here knows how the ownership of these files for Dovecot needs to be in order to work, as various distributions of Dovecot packages seem
to use different users:
I'd like Dovecot not to log into syslog, but to dedicated files. Therefore I've created the directory /var/log/dovecot and told dovecot in 10-logging.conf to log info, debug and error messages to separate files.
But I get error messages from postfix (weird):
(temporary failure. Command output: lda(user): Error: net_connect_unix(/run/dovecot/stats-writer) failed: Permission denied Can't open log file /var/log/dovecot/error.log: Permission denied )
This is the content of /var/log/dovecot:
-rw-r--r-- 1 dovecot dovecot 0 13. Mai 20:50 debug.log
-rw-r--r-- 1 dovecot dovecot 880 13. Mai 21:21 error.log
-rw-r--r-- 1 dovecot dovecot 40K 13. Mai 21:20 info.log
Postfix is chrooted (usuallly) to /var/spool/postfix
My guess is that postfix runs as postfix.
At least processes like local,
smtpd, bounce etc run as that user. But beyond that I have no idea how to find that out. At least there's nothing in the postfix.service or postfix@.service
about that. So I've changed the files to dovecot:postfix 664, but same
error.
Postfix is chrooted (usuallly) to /var/spool/postfix
If postfix complains about /var/log/dovecot it's actually complaining about /var/spool/postfix/var/log/dovecot
You might try
ps -eo pid,user,group,comm | grep postfix
or similar.
May 13 20:55:37 mail postfix/local[2824184]: (...)
Setting the permissions in /var/log/dovecot to 666 actually didn't
solve the problem [...]
"Top posting" (writing the answer above the text that's being replied to)
is literally industry standard behavior.
Also, I don't think you've really cleared out any confusion. Now, how
exactly can dovecot log to /var/log/dovecot/ without (postfix) throwing errors? Because it clearly is for 2 out of 3 files as visible from the file sizes in my original post. Only the debug file is empty, but maybe nothing relevant enough has been found yet. There are entries from master,
imap, imap-login, managesieve-login, anvil and various other processes in info and error. But the error messages from postfix still appear, also seemingly at least vastly slowing down emails being delivered to the users, if not bringing that to a complete halt. Only after commenting out these locations in 10-logging.conf the mails show up for the users.
PS: check the dictionary definition of "literally".
"Top posting" (writing the answer above the text that's being replied
to) is literally industry standard behavior.
But that's still not that helpful for the main issue. Why on earth is
postfix throwing issues about the log files, even when they are world-readable and -writable? It's not that dovecot doesn't log to them,
but it's also not the case that it's an error message that can just be ignored, as it brings mail delivery to a halt.
But why is postfix even holding a lock on it? And how do I prevent that? I never asked it to.
At least, I don't think there should be a different process holding a lock
on it.
No the point is, you are not setting a file path, you are configure dovecot to directly write to these files.
And dovecot is not just one process, there are multiple running as
different users all trying t write into one file. Race conditions are
to be expected. Because these options exist does not mean it is a good decision to use them.
So now that you don't know any further, you just start lying? Now that's rich.
I told you where to look, which is more than you deserve after how youbehave.
You didn't though.
Configure the literal industry standard syslog or journald to use a facilityto your liking and the problem should resolve itself.
The point is, Dovecot has an option to write certain types of logs to different files. While it's doing that great, postfix is upset about that capability. It shouldn't even try to access these files. So the issue is
not being able to log to files, that's already solved, but postfix running crazy when using a very simple setting.
Dovecot expects execution permissions on the directory it writes the logs
to. Because "Standard POSIX permissions for a non-root process to enter a directory." How on earth is that even a thing?
If you have read permission on a directory but *not* execute permissions, then the only thing you can do is read the contents of that directory --
the filenames and their inode numbers. You cannot stat() the files,
so you can't see who owns them or even what kind of files they are.
Just their names.
If you have execute permission but *not* read permission on a directory,
then you can access the files within the directory, but only if you
already know their names. You can't read the directory to get their
names.
Then where does the combination rwx come in here? With read the app knows
the file is there, with write it writes to the file. Question is, where the necessity would be to know the owner of the file or even the kind. The
logger is supposed to just append text to a file.
If you have read permission on a directory but *not* execute permissions,
then the only thing you can do is read the contents of that directory --
the filenames and their inode numbers. You cannot stat() the files,
so you can't see who owns them or even what kind of files they are.
Just their names.
Never found a situation where this as useful.
| Sysop: | Keyop |
|---|---|
| Location: | Huddersfield, West Yorkshire, UK |
| Users: | 546 |
| Nodes: | 16 (2 / 14) |
| Uptime: | 154:56:20 |
| Calls: | 10,383 |
| Files: | 14,054 |
| Messages: | 6,417,848 |