Description Dirk Ahrnke 2021-01-08 17:32:21 CET

With the current rsyslog configuration any INFO-level event will appear in 4 logfiles: dovecot.log, dovecot.info, syslog and messages.
This can not be changed by configuration.

While this may be not interesting in a small environment it will waste disk space one there are several thousands of active users. In additon there will be most likely some performance impact dealing with multiple files in a GiB-region

https://doc.dovecot.org/admin_manual/logging/ has a very simple setting which appears to be sufficient:
local5.*        -/var/log/dovecot.log
local5.warning;local5.error;local5.crit -/var/log/dovecot-errors.log

our configuration:
local5.* -/var/log/dovecot.log
local5.info -/var/log/dovecot.info
local5.warn -/var/log/dovecot.warn
local5.err -/var/log/dovecot.err
:msg,contains,"stored mail into mailbox" -/var/log/dovecot.lmtp

While it might be useful to have seperate logs for ERROR or even WARN I dont see any benefit to duplicate INFO-events to separate logfile when a catch-all exists.

In addition we dont have any configuration which would seperate local5 defined by us in rsyslog.conf. 
There is a UCRV syslog/syslog/avoid_duplicate_messages but this does not take "local5" into account.

From the Dovecot documentation (same URL as above):
Sometimes syslog is configured to log all info level logging to /var/log/messages. You can disable such duplicates for mail by adding “;local5.none”. For example:
*.info;local2.none;authpriv.none;cron.none;local5.none /var/log/messages

This appears to be a reasonable advice.