You are correct that there are no hard and fast rules on how long a clinical trial has to take. There are recommendations or, if you'd like common practices, but the duration of the trial is decided separately for each drug, for each clinical trial phase and even for each individual study (when there is more than one study in a phase).
The FDA website for example, states that the duration of the study is decided by the research team, although it gives common duration span for each phase (emphasis mine):
Patients: 20 to 100 healthy volunteers or people with the disease/condition.
Length of Study: Several months
Purpose: Safety and dosage
Patients: Up to several hundred people with the disease/condition.
Length of Study: Several months to 2 years
Purpose: Efficacy and side effects
Patients: 300 to 3,000 volunteers who have the disease or condition
Length of Study: 1 to 4 years
Purpose: Efficacy and monitoring of adverse reactions
The information on the conducted studies are included in the Summary of Product Characteristics (SPC or SmPC for short), you can find them on-line or from your regulatory agency. However, they do not always include the length of the study. For new medicines the companies sometimes give information about the clinical trials, although depending on the country you are in, this information might be available just to healthcare professionals for prescription medicines (because promotion of prescription medicines direct to consumer is prohibited in many countries).
The fourth, post-marketing phase is not time-limited, it lasts for as long as the medicine is on the market. The health professionals are obliged to report any side-effects that they become aware of that are either associated or even just concomitant to a medicine use. Patients can report any side effects they notice to their health care professional, but very often there is also an option to report directly to the company/manufacturer. Most companies have a section on their website (or at least an e-mail address) dedicated to this, or, depending on the country a patient is in, the adverse effects can be reported by phone. Aside from spontaneous reporting, post-marketing phase studies are also conducted.
This procedure is a part of the pharmacovigilance system. There are various national and international adverse reaction monitoring systems, and these should all contribute to greater knowledge and the better safety of a medicine.
For example, there are laws and good pharamcovigilance practice (GVP) guidelines in the EU, that can be found on the EMeA website. This legislature makes it obligatory for manufacturers to periodically update safety reports and include new findings.