Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

As the title says, I've setup a central RHEL rsyslog server with a couple of RHEL clients forwarding all their logs to it. The logs are being forwarded correctly because when I look at the content of /var/log/* logs on the server, all the client events show up.

However, when I run...

perl /usr/share/logwatch/scripts/logwatch.pl

...on the server, one of the clients does not show up on the report. Don't know if this has anything to do with this at all but, the client that's not showing up used to have logwatch configured at some point. Currently though, I have disabled the functionality and removed all the logwatch files from it.

The content of /usr/share/logwatch/default.conf/logwatch.conf is as follows.

LogDir = /var/log
TmpDir = /var/cache/logwatch
Output=mail
Format=html
MailTo = admin@domain.com
MailFrom = logwatch@domain.com
Print =
Range = yesterday
Detail = Med 
Service = All
mailer = "sendmail -t"
HostLimit = no
SplitHosts = yes
MultiEmail = no
Service = -zz-disk_space

So here are my questions:

  1. Why is this host being excluded?
  2. And secondly, somewhat related, what's the best way to customize the report formatting?

Thank you!

share|improve this question
add comment

1 Answer 1

up vote 0 down vote accepted

Never mind. Looks like I had to give it a day for the logs to accumulate. All the hosts are now showing up on the reports.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.