Thank you @ZhangHuangbin — I can login with postmaster now
ZhangHuangbin wrote:- How much memory does this server have?
total used free shared buff/cache available
Mem: 3.8G 1.6G 1.1G 16M 1.2G 2.2G
Swap: 3.0G 0B 3.0G
ZhangHuangbin wrote:- Does (failed) postmaster account have special characters in password? How about reset its password to a simple one just for testing purpose (and reset it to a strong one after test)?
Yes, it did have special chars, so I have removed them from the password. It's still long, but no special chars. After changing pswd I managed to log in. I am not sure what eventually did the trick, because I had disabled the throttle plugin and restarted some services before checking again. Or it just the fact that the password was changed. My other account uses a password with special characters (a little shorter though) and there isn't a problem. I can't use a short password for a user with known name, because it's a security risk. Ideally, admins should be able to name their global admin user at install. What's the best way to replace postmaster? Would it be OK to demote postmaster to ordinary user status and give global admin privileges to another user?
ZhangHuangbin wrote:- About the empty log files, please restart "rsyslog" service to fix it.
before restarting it showed:
Dec 31 21:44:23 mail rsyslogd[774]: action 'action 6' resumed (module 'builtin:omfile') [v8.32.0 try http://www.rsyslog.com/e/2359 ]
Dec 31 21:44:23 mail rsyslogd[774]: action 'action 6' suspended (module 'builtin:omfile'), retry 0. There should be messages before this one giving the reason for suspension. [v8.32.0 try http://www.rsyslog.com/e/2007 ]
Dec 31 21:44:23 mail rsyslogd[774]: action 'action 6' resumed (module 'builtin:omfile') [v8.32.0 try http://www.rsyslog.com/e/2359 ]
Dec 31 21:44:23 mail rsyslogd[774]: action 'action 6' suspended (module 'builtin:omfile'), retry 0. There should be messages before this one giving the reason for suspension. [v8.32.0 try http://www.rsyslog.com/e/2007 ]
Dec 31 21:44:23 mail rsyslogd[774]: action 'action 6' resumed (module 'builtin:omfile') [v8.32.0 try http://www.rsyslog.com/e/2359 ]
Dec 31 21:44:23 mail rsyslogd[774]: action 'action 6' suspended (module 'builtin:omfile'), retry 0. There should be messages before this one giving the reason for suspension. [v8.32.0 try http://www.rsyslog.com/e/2007 ]
Dec 31 21:44:23 mail rsyslogd[774]: action 'action 6' resumed (module 'builtin:omfile') [v8.32.0 try http://www.rsyslog.com/e/2359 ]
Dec 31 21:44:23 mail rsyslogd[774]: action 'action 6' suspended (module 'builtin:omfile'), retry 0. There should be messages before this one giving the reason for suspension. [v8.32.0 try http://www.rsyslog.com/e/2007 ]
Dec 31 21:44:23 mail rsyslogd[774]: action 'action 6' suspended (module 'builtin:omfile'), next retry is Tue Dec 31 21:44:53 2019, retry nbr 0. There should be messages before this one giving the reason for suspension. [v8.32.0 try http://www.rsyslog.com/e/2007 ]
Jan 01 06:26:04 mail rsyslogd[774]: [origin software="rsyslogd" swVersion="8.32.0" x-pid="774" x-info="http://www.rsyslog.com"] rsyslogd
Now status shows:
Jan 01 19:34:37 mail systemd[1]: Starting System Logging Service...
Jan 01 19:34:37 mail systemd[1]: Started System Logging Service.
Jan 01 19:34:37 mail rsyslogd[28514]: imuxsock: Acquired UNIX socket '/run/systemd/journal/syslog' (fd 3) from systemd. [v8.32.0]
Jan 01 19:34:37 mail rsyslogd[28514]: rsyslogd's groupid changed to 106
Jan 01 19:34:37 mail rsyslogd[28514]: rsyslogd's userid changed to 102
Jan 01 19:34:37 mail rsyslogd[28514]: [origin software="rsyslogd" swVersion="8.32.0" x-pid="28514" x-info="http://www.rsyslog.com"] start
But the following logs are still 0-length in /var/log: alternatives.log, fail2ban.log, kern.log, clamav/clamav.log, dovecot/dovecot.log, dovecot/sieve.log, iredapd/iredapd.log, mlmmjadmin/mlmmjadmin.log. I will look tomorrow. On the other hand journalctl -u fail2ban.service is working well.
