Forwarded to devs Duplicate entries in maillog

[uniauto]

User name: uniauto

TITLE

Duplicate entries in maillog

PRODUCT, VERSION, OPERATING SYSTEM, ARCHITECTURE

Plesk Obsidian 18.0.25 Update #2, Debian 9.12‬

PROBLEM DESCRIPTION

All entries in maillog have doubled

STEPS TO REPRODUCE

tail /var/log/maillog

ACTUAL RESULT

Mar 30 18:00:08 webmail dovecot: imap-login: Login: user=<[email protected]>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=14716, TLS, session=<KGbix44iGrF/AAAB>
Mar 30 18:00:08 webmail dovecot: imap-login: Login: user=<[email protected]>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=14716, TLS, session=<KGbix44iGrF/AAAB>
Mar 30 18:00:08 webmail dovecot: service=imap, user=[email protected], ip=[127.0.0.1]. Logged out rcvd=377, sent=37086
Mar 30 18:00:08 webmail dovecot: service=imap, user=[email protected], ip=[127.0.0.1]. Logged out rcvd=377, sent=37086

EXPECTED RESULT

Mar 30 18:00:08 webmail dovecot: imap-login: Login: user=<[email protected]>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=14716, TLS, session=<KGbix44iGrF/AAAB>
Mar 30 18:00:08 webmail dovecot: service=imap, user=[email protected], ip=[127.0.0.1]. Logged out rcvd=377, sent=37086

ANY ADDITIONAL INFORMATION

Found duplicate instance of "mail.* -/var/log/maillog" in files:
/etc/rsyslog.conf
/etc/rsyslog.d/plesk-mail.conf


Posible fix: remove /etc/rsyslog.d/plesk-mail.conf

YOUR EXPECTATIONS FROM PLESK SERVICE TEAM

Confirm bug

 

[IgorG]

From developer:

Could not confirm bug as duplicated entries in the same file. Debian 9 out of the box configures /var/log/mail.log, Plesk - /var/log/maillog. Earlier I saw 2 files simultaneously with similar entries, but do not face such problem on a new test instance. Is that server has long Plesk upgrade history?

 

[uniauto]

Not long (like 6months), its an VPS from OVH, Plesk Onyx on Debian 8 immediately updated to Debian 9 and Plesk Obsidian 18.0.20.

 

[IgorG]

Most probably the issue is caused by dist upgrade.

 

[jouytxi]

Same issue here in two Debian 8, and Plesk 18.0.26 servers.

I have also both entries in /etc/rsyslog.conf and /etc/rsyslog.d/plesk-mail.conf refering to mail log (mail.* -/var/log/maillog)

They came from Plesk Onix and where upgraded to Obsidian following the plesk upgrade link inside the panel.

 

[ChristophRo]

Just checked the logfiles on our Debian9 server as well, and here we see the duplicate entries also.
And this for sure has nothing to do with a dist-upgrade, as this server was Debian9 from the get-go and this problem must be relatively new. (because I remember/know this was not always the case)


Ahh, looks like it's caused by the file /etc/rsyslog.d/plesk-mail.conf that was added to Plesk/Debian9 in October 2019 or so.
This one defines the /var/log/maillog location as well as the /etc/rsyslog.conf file that was used/adjusted by Plesk/Debian9 before that

So in order to fix this problems (that seems to happen only for Debian9 servers that were installed before Q4 2019) I recommend that you comment this line in /etc/rsyslog.conf that defined the /var/log/maillog location

 

[frg62]

Same problem on two Debian 8.11 servers, both using Plesk Obsidian, one 18.0.26 and the other 18.0.27.

In both cases, the solution presented by @ChristophRo did the trick!

 

[peterbo]

Same Problem on Debian 9.12 (no dist-upgrade) with Plesk 18.0.28-2.

 

[themew]

Seeing double log entries as well in CentOS 8.2 in all logs.

 

[Achim Drees]

Seeing double log entries as well in CentOS 8.2 in all logs.

yes, same here

 

[themew]

Interesting that the double log entry issue does not occur in Ubuntu 20.04, but we see it in CentOS 8.

 

[RubenT]

Interesting that the double log entry issue does not occur in Ubuntu 20.04, but we see it in CentOS 8.

Did you find a solution?

I managed to solve it in Debian servers, but no in Centos (7.9) ones.

 

[mow]

Most probably the issue is caused by dist upgrade.

No, it is caused by plesk upgrade. The file appeared when plesk upgraded itself from onyx to obsidian 18.0.35 on May 25th (debian 9).
Which created /etc/rsyslog.d/plesk-mail.conf but didn't remove the entry in /etc/rsyslog.conf.

That this happened more than a year after the issue was first reported is not really encouraging.