Replace watching log file with network logging

[mlandauer]

Postfix logs to syslog which logs by default to a file. We're tailing the file for info.

It would be nicer if we asked syslog to forward mail logs to another syslog server which is a special server that we write that parses the log files.

We can also ask syslog to queue logs in case our daemon ever goes down.

This has a few advantages:

• We don't have to reparse the entire log file when the log daemon is restarted. We just get new stuff.
• We don't have to deal with the complexity that log rotation brings to the whole affair (which frankly we're pretty much ignoring at the moment)
• It will make turning the postfix server into a docker container easier (as we won't need to expose any of the filesystem). We can do everything via the network.

[lorello]

Have you evaluated Fluentd or Logstash instead of a daemon written from scratch?

You could configure Fluentd or Logstash to read from postfix logfile and solve for you the problems about file rotation or daemon restart. They both can forward logs to Mysql or Mongodb or ElasticSearch and many other destinations.

In a docker environment postfix should log to standard output and you can forward container logs from the docker host to a remote Fluentd or Logstash service, probably running in another container.

My 2 cents :-)

[mlandauer]

:+1: to using Logstash