(Sorry, meant to file as a security task)

Are you going to delete the really old ones straight off?

James is going to check with legal, but it's probably not going to be a major issue though.

I can just delete all IP addresses from old logs if that works.

@Ladsgroup Thanks - that would be great! Presumably this problem goes away with migration to Mailman3? Do we need to set up any kind of log rotation there to prevent this from happening again?

If I'm reading the logrotate config correctly:

/var/log/mailman/subscribe /var/log/mailman/post {
	su root list
	monthly
	missingok
	create 0664 list list
	rotate 12
	compress
	delaycompress
        sharedscripts
        postrotate
            [ -f '/var/run/mailman/mailman.pid' ] && /usr/lib/mailman/bin/mailmanctl -q reopen || exit 0
        endscript
}

montly + rotate 12 ends up keeping logs for a whole year.

In Mailman3 we don't have a separate subscriber log (we can rely on Apache2 access logs), but I checked the logrotate config anyways and it only keeps them for 5 days max.

legoktm@lists1001:/var/log/mailman3$ cat /etc/logrotate.d/mailman3
/var/log/mailman3/mailman.log {
	daily
	rotate 5
	compress
	delaycompress
	missingok
	notifempty
	create 640 list list
	postrotate
		if /etc/init.d/mailman3 status >/dev/null; then \
		    /usr/bin/mailman-wrapper reopen >/dev/null; \
		fi;
	endscript
}
legoktm@lists1001:/var/log/mailman3$ cat /etc/logrotate.d/mailman3-web 
/var/log/mailman3/web/mailman-web.log {
	copytruncate
	daily
	rotate 5
	compress
	delaycompress
	missingok
	notifempty
	create 640 www-data www-data
}

However, that config doesn't cover bounce.log, debug.log, plugins.log, smtp.log. I'll file a separate task for that.

I deleted all IPs from old subscribe files.

couldn't find anything old in logs beside subscribe. It's only post logs but they don't have any IPs in them AFAICS

Anything else that needs to be done on this?

Preventing this from happening again would be an action but hopefully once we shut down mm2 (this week, fingers crossed) and after a while delete the logs, we can consider it done I assume.