Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have added the following to /etc/postfix/header_checks so that postfix will log the subject lines of every email:

/^subject: /    WARN

This produces log entries in /var/log/mail.log like:

May 19 07:10:48 server postfix/cleanup[1737]: 12E9DB13A3: warning: header Subject: Test Message; from=<www-data@server.domain>

And my logwatch report contains:

Header content warning (but passed): 1 Reason(s), 2030 time(s)

I have put both of the following in my /etc/logwatch/conf/ignore.conf, but they do not seem to avoid this message:

warning: header Subject:
Header content warning (but passed): 1 Reason(s)

Can anyone tell me what I am doing wrong?

share|improve this question
up vote 2 down vote accepted

The second attempt in /etc/logwatch/conf/ignore.conf is correct, except that the brackets need to be escaped. Adding a backslash before each bracket caused logwatch to correctly ignore the lines.

share|improve this answer

Just for the records: logwatch uses Perl style regexes in ignore.conf. So look at

$ man 1 perlre
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.