Rsyslog facility based selectors not working for Dovecot

[Jonas Holmgren]

Post system upgrade from 14.04.4 to 16.04.1, Rsyslog facility/priority based selectors are no longer working for Dovecot 2.2.22. For instance, "imap-login" events do not appear in the logfiles, while "lmtp" events, which in our case are captured using property-based filters, do.

/etc/rsyslog.d/23-dovecot.conf
local5.* -/var/log/dovecot.log
local5.warn;local5.err;local5.crit -/var/log/dovecot.err
:msg,contains,"lmtp" -/var/log/dovecot.log
:msg,contains,"sieve" -/var/log/dovecot.log

& stop

/etc/dovecot/conf.d/10-logging.conf:
log_path = syslog
syslog_facility = local5
auth_verbose = yes

The configuration has not been changed since it was last working, i.e. before the upgrade. Changing log_path directive in Dovecot from "syslog" to a valid file path is a working workaround:

/etc/dovecot/conf.d/10-logging.conf:
log_path = /var/log/dovecot.log

[Brady Shea (bmatthewshea)]

Similar problem. Works under 14.04 not under 16.04.

>>16.04:

/etc/dovecot/conf.d/10-logging.conf:

log_path = syslog
syslog_facility = local5
auth_verbose = yes

/etc/rsyslog.d/dovecot.conf :

local5.*;local5.!err -/var/log/dovecot.log
local5.debug -/var/log/dovecot-debug.log
local5.info,local5.notice;local5.!warn;local5.!err;local5.!crit;local5.!alert;local5.!panic -/var/log/dovecot-info.log
local5.warn -/var/log/dovecot-errors.log

$ sudo doveadm log find

Debug: /var/log/dovecot-info.log
Info: /var/log/dovecot-info.log
Warning: /var/log/dovecot.log
Error: /var/log/dovecot.log
Fatal: /var/log/dovecot.log

>> 14.04 (using same configs above):

$ sudo doveadm log find

Looking for log files from /var/log
Debug: /var/log/dovecot-debug.log
Debug: /var/log/dovecot.log
Info: /var/log/dovecot-info.log
Info: /var/log/dovecot-debug.log
Info: /var/log/dovecot.log
Warning: /var/log/dovecot-debug.log
Warning: /var/log/dovecot-errors.log
Warning: /var/log/dovecot.log
Error: /var/log/dovecot-debug.log
Error: /var/log/dovecot-errors.log
Fatal: /var/log/dovecot-debug.log
Fatal: /var/log/dovecot-errors.log

(Correct)