• We value your experience with Plesk during 2024
    Plesk strives to perform even better in 2025. To help us improve further, please answer a few questions about your experience with Plesk Obsidian 2024.
    Please take this short survey:

    https://pt-research.typeform.com/to/AmZvSXkx
  • The Horde webmail has been deprecated. Its complete removal is scheduled for April 2025. For details and recommended actions, see the Feature and Deprecation Plan.
  • We’re working on enhancing the Monitoring feature in Plesk, and we could really use your expertise! If you’re open to sharing your experiences with server and website monitoring or providing feedback, we’d love to have a one-hour online meeting with you.

Forwarded to devs Duplicate entries in maillog

uniauto

Basic Pleskian
User name: uniauto

TITLE

Duplicate entries in maillog

PRODUCT, VERSION, OPERATING SYSTEM, ARCHITECTURE

Plesk Obsidian 18.0.25 Update #2, Debian 9.12‬

PROBLEM DESCRIPTION

All entries in maillog have doubled

STEPS TO REPRODUCE

tail /var/log/maillog

ACTUAL RESULT

Mar 30 18:00:08 webmail dovecot: imap-login: Login: user=<[email protected]>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=14716, TLS, session=<KGbix44iGrF/AAAB>
Mar 30 18:00:08 webmail dovecot: imap-login: Login: user=<[email protected]>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=14716, TLS, session=<KGbix44iGrF/AAAB>
Mar 30 18:00:08 webmail dovecot: service=imap, user=[email protected], ip=[127.0.0.1]. Logged out rcvd=377, sent=37086
Mar 30 18:00:08 webmail dovecot: service=imap, user=[email protected], ip=[127.0.0.1]. Logged out rcvd=377, sent=37086

EXPECTED RESULT

Mar 30 18:00:08 webmail dovecot: imap-login: Login: user=<[email protected]>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=14716, TLS, session=<KGbix44iGrF/AAAB>
Mar 30 18:00:08 webmail dovecot: service=imap, user=[email protected], ip=[127.0.0.1]. Logged out rcvd=377, sent=37086

ANY ADDITIONAL INFORMATION

Found duplicate instance of "mail.* -/var/log/maillog" in files:
/etc/rsyslog.conf
/etc/rsyslog.d/plesk-mail.conf


Posible fix: remove /etc/rsyslog.d/plesk-mail.conf

YOUR EXPECTATIONS FROM PLESK SERVICE TEAM

Confirm bug
 
From developer:

Could not confirm bug as duplicated entries in the same file. Debian 9 out of the box configures /var/log/mail.log, Plesk - /var/log/maillog. Earlier I saw 2 files simultaneously with similar entries, but do not face such problem on a new test instance. Is that server has long Plesk upgrade history?
 
Not long (like 6months), its an VPS from OVH, Plesk Onyx on Debian 8 immediately updated to Debian 9 and Plesk Obsidian 18.0.20.
 
Most probably the issue is caused by dist upgrade.
 
Last edited:
Same issue here in two Debian 8, and Plesk 18.0.26 servers.

I have also both entries in /etc/rsyslog.conf and /etc/rsyslog.d/plesk-mail.conf refering to mail log (mail.* -/var/log/maillog)

They came from Plesk Onix and where upgraded to Obsidian following the plesk upgrade link inside the panel.
 
Just checked the logfiles on our Debian9 server as well, and here we see the duplicate entries also.
And this for sure has nothing to do with a dist-upgrade, as this server was Debian9 from the get-go and this problem must be relatively new. (because I remember/know this was not always the case)


Ahh, looks like it's caused by the file /etc/rsyslog.d/plesk-mail.conf that was added to Plesk/Debian9 in October 2019 or so.
This one defines the /var/log/maillog location as well as the /etc/rsyslog.conf file that was used/adjusted by Plesk/Debian9 before that

So in order to fix this problems (that seems to happen only for Debian9 servers that were installed before Q4 2019) I recommend that you comment this line in /etc/rsyslog.conf that defined the /var/log/maillog location
 
  • Like
Reactions: mow
Same problem on two Debian 8.11 servers, both using Plesk Obsidian, one 18.0.26 and the other 18.0.27.

In both cases, the solution presented by @ChristophRo did the trick! :cool:
 
Interesting that the double log entry issue does not occur in Ubuntu 20.04, but we see it in CentOS 8.
 
Most probably the issue is caused by dist upgrade.
No, it is caused by plesk upgrade. The file appeared when plesk upgraded itself from onyx to obsidian 18.0.35 on May 25th (debian 9).
Which created /etc/rsyslog.d/plesk-mail.conf but didn't remove the entry in /etc/rsyslog.conf.

That this happened more than a year after the issue was first reported is not really encouraging.
 
Back
Top