Structured JSON Logging with Amavis

Posted by Markus Benning on December 28, 2014

Amavis is able to output an structured JSON log format. First make sure you syslog daemon allows log messages longer than 1500 bytes. For example in rsyslogd you can use the following configuration line to raise the maximum message size to 32k:

$MaxMessageSize 32k

To activate JSON logging in amavisd you need to adjust the $logline_maxlen setting since amavis will otherwise split long log lines at this threshold.

The log format in amavis is defined by the $log_templ template. For JSON logging you have to use the report_json macro:

$logline_maxlen = ( 32*1024 ) - 50; # 32k max message size, keep 50 bytes for syslog
$log_templ = <<'EOD';
[:report_json]
EOD

For more macros take a look at the amavis documentation:

README.customize.txt