Server 5.2 missing SMTP Logs

Using 'log show' with data range produces zero output for me.

Whereas the 'log stream' version gives output as soon as the next process message is posted.

Anything wrong with my command below? Anyone else have this issue?

log show --start "2017-03-01" --end "2017-03-25" --predicate '(process == "smtpd") || (process == "smtp")' -info

OUTPUT:

Timestamp Thread Type Activity PID

-------------------------------------------------------------------------------- ------------------------------------

Log - Default: 0, Info: 0, Debug: 0, Error: 0, Fault: 0

Activity - Create: 0, Transition: 0, Actions: 0

First line in /etc/syslog.conf states:

# Note that flat file logs are now configured in /etc/asl.conf

When I check the content of /etc/asl/com.apple.mail it shows:

# mail facility has its own log file

? [= Facility mail] [<= Level debug] claim only

> /var/log/mail.log mode=0644 format=bsd rotate=seq compress file_max=5M all_max=50M

I then check /etc/asl.conf and can't see any reference to the above. So possibly the configuration lines for mail.log are missing in /etc/asl.conf.

I will add the content of /etc/asl/com.apple.mail to /etc/asl.conf as the syntax looks the same and restart mail. See what happens.

Sorry, no effect. I will try to find out what the real cause is.

Any luck?

I've configured the logging level to info across the mail.settings range of available options. But that had no effect either.

While it's not a show stopper, it certainly is annoying.

I've given up, let Apple fix their own bugs. And this new macOS Sierra and Server app sure have a lot.

Apple have a new log system in Sierra. It is not using the log files or asl.

The logs are in memory or a log db.

log -- Access system wide log messages created by os_log, os_trace and other logging systems.

You can read the smtpd log from terminal with this command.

log show --start "2016-10-16" --end "2016-10-17" --predicate 'process == "smtpd"' --debug

Thank you for your answer but the output of your command line does not give nearly as much information as it used to have in previous versions. I want Apple to revert this chance and give us the old logging back. It is essential to have insight in the information of the old loggings as I need it to block persistent spammers and for other purposes.

For now I've created a shell script and put in in the crontab so I don't have to resolve to using Terminal and the SMTP log can be viewed in Server.app.

----------

#!/bin/bash

NOW=$(date +"%Y-%m-%d")

/bin/rm /var/log/mail.log && touch /var/log/mail.log

/usr/bin/log show --start "$NOW" --end "$NOW" --predicate 'process == "smtpd"' --info > /var/log/mail.log

----------

This doesn't help me much either, I need to be able to quickly hunt down specific messages based on recipient addresses so I can confirm that they actually got sent out by the server. And if not, why.

There is a lot of things to be fixed around log system.

At the moment, this syntax of the log command could help:

log stream --predicate '(process == "smtpd") || (process == "smtp")' -info

Thank you very much, that is exactly what I needed to fix my problem!

It seems that after an upgrade or a new install the log level of smtp is at such a high level, it does not report anything unless there is a serious error with the smtp server.

Try these commands to get smtp logging going again, worked for me with a couple of servers who did not seem to have any smtp logging enabled, but mail worked and outgoing as well:

sudo serveradmin settings mail:postfix:log_level = "debug"

sudo serveradmin settings mail:postfix:mail_events_log_level = "debug"

Goodluck!

Jeffrey

Here on my test server, default loglevel was "info". I changed it to "debug" level, but with no luck.

I can't see smtp logs in Console utility, as I can't see smtp logs in Server.app log section.

It seems that the ongoing stream can be viewed in terminal with

log stream --predicate '(process == "smtpd") || (process == "smtp")' -info

And the old logs can be viewed with the command

log show --start "2016-11-06" --end "2016-11-07" --predicate '(process == "smtpd") || (process == "smtp")' -info

with loglevel mode set to "info". (fine tuning with hour:minutes also allowed, see "man log" command in terminal)

So, informations are stored in log system, but something odd happens when console utility perform a query on the log database.

It's enough for me to trace what is going and for troubleshooting purpose.

If anyone finds something better to share, I'd like it very much!

Of all the above suggestions so far, I find that

log stream --predicate '(process == "smtpd") || (process == "smtp")' -debug

produces results closest to what I was used to seeing in the mail.log prior to Server 5.2. My question is: if I can figure out a way to autolaunch that command in Terminal when my Mac Server boots up, would there be any foreseeable problems in my just keeping the log stream running indefinitely, and maybe just minimizing that Terminal window to the Dock? It may get pretty long even after just running 24 hours (we have about 7 user mail accounts). I also assume that log stream won't auto-archive and roll over like most traditional logs, either, right?

I explained how to do this a few answers back. Basically you create a bash script. a good place for this would be /usr/local where you can create a new folder called scripts. In this folder you create a file with the following content (without the dash lines).

---------

#!/bin/bash

THEN=$(date -v-1d +"%Y-%m-%d")

NOW=$(date +"%Y-%m-%d %T")

/bin/rm /var/log/mail.log && touch /var/log/mail.log

/usr/bin/log show --start "$THEN" --end "$NOW" --predicate '(process == "smtp") || (process == "smtpd")' -debug > /var/log/mail.log

---------

You then make this executable by running the command chmod a+x filename.sh and then create a cron tab with this file every day at a given interval, I use 10 minutes. You may then see the log generated in the Server.app.