Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

As the title says, I've setup a central RHEL rsyslog server with a couple of RHEL clients forwarding all their logs to it. The logs are being forwarded correctly because when I look at the content of /var/log/* logs on the server, all the client events show up.

However, when I run...

perl /usr/share/logwatch/scripts/

...on the server, one of the clients does not show up on the report. Don't know if this has anything to do with this at all but, the client that's not showing up used to have logwatch configured at some point. Currently though, I have disabled the functionality and removed all the logwatch files from it.

The content of /usr/share/logwatch/default.conf/logwatch.conf is as follows.

LogDir = /var/log
TmpDir = /var/cache/logwatch
MailTo =
MailFrom =
Print =
Range = yesterday
Detail = Med 
Service = All
mailer = "sendmail -t"
HostLimit = no
SplitHosts = yes
MultiEmail = no
Service = -zz-disk_space

So here are my questions:

  1. Why is this host being excluded?
  2. And secondly, somewhat related, what's the best way to customize the report formatting?

Thank you!

share|improve this question
up vote 0 down vote accepted

Never mind. Looks like I had to give it a day for the logs to accumulate. All the hosts are now showing up on the reports.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.