Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have set up Logwatch on my (Debian) system. Mailing etc works well.

What I would like to is to get a daily report of the system once a day

And;

To receive any high level (failed login attempts, attacks -if possible- etc) immediately as they happen.

Which settings do I need to modify and modify with what exactly? I am quite a newbie when it comes to working with systems and I did my research on Google but the results only lead me thus far.

Thank you.

share|improve this question
    
Agreed with Michael below. You're trying to use the wrong tool. Logwatch is a batch processing system, designed to be run occasionally. –  EEAA Oct 22 '12 at 18:21
add comment

2 Answers 2

up vote 3 down vote accepted

LogWatch runs once per day, from cron -- If you want more frequent notifications you can run LogWatch more frequently, but that this will send you everything that LogWatch normally complains about.

If you want to watch for specific messages you should be using something more sophisticated than LogWatch (syslog-ng with custom filters/actions springs immediately to mind, particularly if you want "immediate" notifications), or writing your own tool to scan the log files on a tighter schedule.


Be Careful What You Wish For

Asking your system to send you emails for every "important" event can quickly become overwhelming. For example there are over 1000 failed login attempts on my personal system TODAY (in the past 11 hours) -- I certainly don't want to be emailed for each one of those: I have enough spam.

Proper monitoring and alerting should only be telling you about things that require action on your part (LogWatch in my experience is awful at that, to the point where I've completely disabled it in my environment because it's just creating noise) -- Make sure whatever system you implement has a very low noise level so you don't fall into the all-too-common trap of ignoring alerts because "I see that all the time and it's never important".

share|improve this answer
    
Thank you voretaq. Could you please advise on which exact watching tools do you use and what settings do you have? (what do you think is worthy of getting notified about). –  Phil Oct 22 '12 at 18:48
    
I generally don't monitor system logs - instead I use performance based monitoring (response time, resource utilization, hardware issues (dead disk, etc.)), operational status notification (up/down/degraded/unexpected-response) and a basic IDS (Snort) to tell me if something "interesting" is going on on the network. In my environment logs are only for debugging a problem that the monitoring system has alerted us to (or one it didn't catch). –  voretaq7 Oct 22 '12 at 18:56
    
And what are your preferences in regards for the tools used to perform these tasks? –  Phil Oct 22 '12 at 19:01
1  
@Phil Take your pick - the right tool is the one that meets your requirements. I user Intermapper, lots of people use Nagios, or Opsview, or OpenNMS... –  voretaq7 Oct 22 '12 at 19:14
    
Thank you voretaq! I will check them all. –  Phil Oct 22 '12 at 19:24
show 1 more comment

Assuming you're using rsyslog, which is the default on Debian squeeze:

Use rsyslog's mail output module to send yourself email. You can configure which messages get sent to you in the usual way:

*.emerg  :ommail:;mailBody

or by matching text in the log message:

if $msg contains 'hard disk fatal failure' then :ommail:;mailBody
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.