Logger (ZCS 6.0.x and later)
Logger in version 6.0 (GnR)
Logger is a non-essential ZCS service that processes logs produced by Zimbra, and associated services. Logs are processed into a format that is readily displayed in the Zimbra Admin Console indicating real-time service status, MTA/spam/virus traffic and performance statistics.
What's changed since 5.0 (and earlier)
The logger service has been completely redesigned and redeveloped for ZCS 6.0
The service no longer relies on mysql and most command-line utilities related to the old service are no longer available.
zmmsgtrace has been removed with no plan for a replacement.
This process is launched through zmloggerctl and runs on a pipe from zmlogswatch, it tails /var/log/zimbra.log and captures information from the 'zimbramon' and 'mailboxd' services and parses out statistics information.
Zmlogger reads an sqlite database to determine the type of each stat counter and mappings to RRD file:data-columns and writes the stat counters to the appropriate RRD file(s).
Log entries that are unknown are spooled into an 'unprocessed.log' file
Zmlogprocess is launched out of cron on the logger host every 5 minutes and reads the 'unprocessed.log' created by zmlogger. Upon launch, zmlogprocess renames 'unprocessed.log' so that zmlogger can start spooling to a new file.
This job reads MTA data from unprocessed.log: MTA traffic and volume, SPAM and Virus infections. The data is then sent back to zmlogger as stat counters via syslog.
Zmstats is also integrated into the logger service by broadcasting its stat counters over syslog in addition to using the old CSV files.
Stats will still be readable using the zmstat-chart tool in addition to live, real-time data displayed in the admin console.
The logger service will use syslog as a mechanism for aggregating data to a centralized server. Messages are generally sent in the format of
message-type: headers(csv):: data-columns(csv)
Long messages are broken up using a uuid eliding scheme.