Postfix connected to Load Balancer, how to turn down connect/disconnect messages in mail.log
We have a few Postfix servers connected to our F5 Load Balancer which checks for a connection on port 25 every couple seconds to the servers to make sure it's available. Unfortunately this creates quite a lot of noise in the logs, and I'd rather watch this from the Load Balancer than from the mail server if there is a disconnect from the load balanced pool.
Here's what the messages are like, every couple seconds:
Oct 19 10:34:46 mail postfix/smtpd[14755]: connect from unknown[x.x.x.x]
Oct 19 10:34:46 mail postfix/smtpd[14755]: lost connection after CONNECT from unknown[x.x.x.x]
Oct 19 10:34:46 mail postfix/smtpd[14755]: disconnect from unknown[x.x.x.x]
Oct 19 10:34:49 mail postfix/smtpd[14755]: connect from unknown[x.x.x.x]
Oct 19 10:34:49 mail postfix/smtpd[14755]: lost connection after CONNECT from unknown[x.x.x.x]
Oct 19 10:34:49 mail postfix/smtpd[14755]: disconnect from unknown[x.x.x.x]
Oct 19 10:34:51 mail postfix/smtpd[14755]: connect from unknown[x.x.x.x]
Oct 19 10:34:51 mail postfix/smtpd[14755]: lost connection after CONNECT from unknown[x.x.x.x]
Oct 19 10:34:51 mail postfix/smtpd[14755]: disconnect from unknown[x.x.x.x]
I'd rather just see information related to the mail server and sending mail - but anything related to the connect and disconnect from these two IP addresses (the load balancers) I could care less about and would rather not have that spamming the logs.
What are my options here? My Postfix configuration is very bland/basic, and I'm not doing any sort of logging or debugging other than the default (except for smtpd_helo_restrictions = warn_if_reject check_helo_access static:reject which I'm using to track HELOs to keep us off the blacklist, but is not related to this).
alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
append_dot_mydomain = no
biff = no
config_directory = /etc/postfix
inet_interfaces = all
inet_protocols = all
mailbox_command = procmail -a "$EXTENSION"
mailbox_size_limit = 0
mydestination = mail.contoso.com, localhost.localdomain, localhost
myhostname = mail.contoso.com
mynetworks = 10.0.0.0/8 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
myorigin = /etc/mailname
readme_directory = no
recipient_delimiter = +
relayhost = smtp-relay.gmail.com
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
smtpd_helo_restrictions = warn_if_reject check_helo_access static:reject
smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
smtpd_tls_cert_file = /etc/ssl/certs/ssl-cert-snakeoil.pem
smtpd_tls_key_file = /etc/ssl/private/ssl-cert-snakeoil.key
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtpd_use_tls = yes
Assuming you are running defaults, this is actually a syslog question not a postfix question, as postfix sends these events to syslog, and then syslog (likely rsyslog) does the handling.
You'll want to filter out these messages:
- Rsyslog
:msg, contains, "from unknown[x.x.x.x]" ~
- Syslog-ng
@version: 3.5
filter f_F5 {message not ("from unknown[x.x.x.x]");};
What monitor are you using on the BIG-IP to check the SMTP node health? If you're using a basic TCP which only looks for a socket connection, that's fixable.
There are SMTP monitors you can configure that will run a EHLO/QUIT to cleanly close the connection. This is another bonus because it will wait until SMTP services are available after a node reset, instead of TCP availability.
If you can, check out this: https://devcentral.f5.com/questions/difference-between-tcp-monitor-and-smtp-monitor
While you can clean out logs, it's better to fix the issue. And remember to test this out pre-production before you drop your SMTP server accidentally.
-Chase