2

I have set up Logwatch on my (Debian) system. Mailing etc works well.

What I would like to is to get a daily report of the system once a day

And;

To receive any high level (failed login attempts, attacks -if possible- etc) immediately as they happen.

Which settings do I need to modify and modify with what exactly? I am quite a newbie when it comes to working with systems and I did my research on Google but the results only lead me thus far.

Thank you.

1
  • Agreed with Michael below. You're trying to use the wrong tool. Logwatch is a batch processing system, designed to be run occasionally.
    – EEAA
    Oct 22, 2012 at 18:21

2 Answers 2

4

LogWatch runs once per day, from cron -- If you want more frequent notifications you can run LogWatch more frequently, but that this will send you everything that LogWatch normally complains about.

If you want to watch for specific messages you should be using something more sophisticated than LogWatch (syslog-ng with custom filters/actions springs immediately to mind, particularly if you want "immediate" notifications), or writing your own tool to scan the log files on a tighter schedule.


Be Careful What You Wish For

Asking your system to send you emails for every "important" event can quickly become overwhelming. For example there are over 1000 failed login attempts on my personal system TODAY (in the past 11 hours) -- I certainly don't want to be emailed for each one of those: I have enough spam.

Proper monitoring and alerting should only be telling you about things that require action on your part (LogWatch in my experience is awful at that, to the point where I've completely disabled it in my environment because it's just creating noise) -- Make sure whatever system you implement has a very low noise level so you don't fall into the all-too-common trap of ignoring alerts because "I see that all the time and it's never important".

5
  • Thank you voretaq. Could you please advise on which exact watching tools do you use and what settings do you have? (what do you think is worthy of getting notified about).
    – Phil
    Oct 22, 2012 at 18:48
  • I generally don't monitor system logs - instead I use performance based monitoring (response time, resource utilization, hardware issues (dead disk, etc.)), operational status notification (up/down/degraded/unexpected-response) and a basic IDS (Snort) to tell me if something "interesting" is going on on the network. In my environment logs are only for debugging a problem that the monitoring system has alerted us to (or one it didn't catch).
    – voretaq7
    Oct 22, 2012 at 18:56
  • And what are your preferences in regards for the tools used to perform these tasks?
    – Phil
    Oct 22, 2012 at 19:01
  • 1
    @Phil Take your pick - the right tool is the one that meets your requirements. I user Intermapper, lots of people use Nagios, or Opsview, or OpenNMS...
    – voretaq7
    Oct 22, 2012 at 19:14
  • @Phil If you poke around in the monitoring tag on this site you'll find lots of other options/opinions
    – voretaq7
    Oct 22, 2012 at 20:27
5

Assuming you're using rsyslog, which is the default on Debian squeeze:

Use rsyslog's mail output module to send yourself email. You can configure which messages get sent to you in the usual way:

*.emerg  :ommail:;mailBody

or by matching text in the log message:

if $msg contains 'hard disk fatal failure' then :ommail:;mailBody

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .