Tools Index

Logwatch

Install logwatch, ports collection contains deepthought.httpup port;

        $ prt-get depinst logwatch

1.1. Configure

Logwatch apply configuration state using layers of configuration files, last in the list is most important;

/usr/share/logwatch/default.conf/*
/etc/logwatch/conf/*
command line arguments

From logwatch documentation;

	The contents of the three directories /usr/share/logwatch/default.conf,
	/usr/share/logwatch/dist.conf, and /etc/logwatch/conf, all have the
	same structure:

		services:	This subdirectory contains the configuration
				files specific to each service.  Logwatch
				determines which services are available by
				examining the contents of this directory.
				Each service configuration file is named by
				its service name with the ".conf" suffix.

		logfiles:	This subdirectory contains the logfile group
				configuration files.  Each logfile group
				configuration file contains information about
				one or more log files with the same format.
				Several services may use the same logfile
				group configuration file.  Each of these
				configuration files are named by the group
				name with the ".conf" suffix.  Many
				of the group names are taken from the name
				of a system log file (such as messages,
				maillog, secure, etc.), but not always.

		logwatch.conf:	This file contains the defaults for the
				overall execution of Logwatch, and affect all
				of its services.  Many of its parameters can
				be overridden by command-line switches when
				invoking the Logwatch executable, as described
				in the man page for Logwatch.

		ignore.conf:	This file specifies regular expressions that,
				when matched by the output of logwatch, will
				suppress the matching line, regardless of which
				service is being executed.

	The /etc/logwatch/conf directory may also contain the file 'override.conf',
	which is described in section 4, "Customizing the Configuration."

Copy default configuration to use as a template;

        $ sudo cp /usr/share/logwatch/default.conf/logwatch.conf /etc/logwatch/conf/

Example configuration;

        MailTo = admin@machine
        MailFrom = logwatch
        Range = Today
        Detail = Med

Default activate all services, to enable per service edit /usr/share/logwatch/default.conf/logwatch.conf;

        #Service = All

Then add the services to /etc/logwatch/conf/logwatch.conf;

        Service = http
        Service = exim
        Service = dhcpd

        $ sudo /usr/share/logwatch/scripts/logwatch.pl

1.2. Set cron task

First make sure that email gets deliver;

        $ sudo /usr/share/logwatch/scripts/logwatch.pl --output mail

Create file /etc/cron/daily/logwatch;

        #!/bin/sh
        #
        # /etc/cron/daily/logwatch: run logwatch and mail output
        #

        /usr/share/logwatch/scripts/logwatch.pl --output mail

        # End of file

        $ sudo chmod +x /etc/cron/daily/logwatch

Tools Index