wow. I’m an idiot.
I have no idea how Logs in Cockpit populates, it doesn’t match up with what I see in /var/logs, yet I can set it to Everything - All and it shows rspamd stuff, dovecot… those aren’t in Messages. wtf?
Anyway, I don’t have time for this right now. I do now realize that Cockpit - Logs is useless to me so going forward I won’t waste anymore time there, I’ll just use shell.
At least the Logs in Applications actually shows the logs for those modules, so there’s that.
All these years I thought Logs were Logs and I’ve been confused as to why I can’t find what I need.
Thanks @mrmarkuz you’ve given me the push I needed to understand what I didn’t understand.