Logwatch is a tool that will monitor your server's logs and email the administrator a digest on a daily basis, and is primarily used on Linux-based distros.

learn more… | top users | synonyms

0
votes
1answer
42 views

How can I modify the disk space output of Logwatch?

I've got logwatch sending me reports every day and part of that report is a disk space analysis. I was wondering how I could modify the disk space script to put emphasis on disks that are greater than ...
0
votes
1answer
65 views

Prevent empty apache requests in access.log

In my access.log file I found a hundreds of lines of empty request like this mydomain.com:80 [ip-address] - - [02/Jul/2014:09:11:20 -0500] "GET / HTTP/1.0" 200 25491 "-" "-" mydomain.com:80 ...
0
votes
1answer
88 views

logwatch on Centos 6.4

My logwatch is configured correctly and is working correctly when I issue manually /usr/sbin/logwatch I added it to root's crontab and it is listed correctly when I make crontab -l which gives: 0 ...
0
votes
0answers
47 views

Can I use logwatch to let me know when PolicyD (a.k.a. cluebringer) is rejecting a given user?

I have set up PolicyD so that when a given user (tracked by SMTP auth) sends more than 50 messages in 20 minutes, it starts rejecting mail from that user. I can see entries in the mail logs when ...
0
votes
1answer
132 views

Cannot close Port 25 after installing postfix

Before installing logwatch (which installs postfix) on Ubuntu 12.04, the port 25 is blocked by iptables/csf PORT STATE SERVICE 25/tcp filtered smtp After installing logwatch (which installs ...
-2
votes
1answer
179 views

monitor rsnapshot's log file with logwatch [closed]

How does one go about including rsnapshot's log file in logwatch's configuration? Logwatch is software that will parse logs and check for important information and email it to someone. How can one ...
0
votes
1answer
159 views

How to retrieve all the system mails like LogWatch

Hi if you have a handful of servers around each with LogWatch installed and generating a daily summary mail for you, how do you retrieve these mails? At the moment I only have Dovecot installed on ...
9
votes
2answers
5k views

What does “Normal Shutdown, Thank you for playing [preauth]” In SSH logs mean?

Recently, My SSH log summaries for my Ubuntu 12.04 servers in Logwatch have started showing entries for "11: Normal Shutdown, Thank you for playing [preauth]" along with the "11: Bye Bye [preauth]" ...
0
votes
1answer
40 views

Are these disk errors cause for concern?

Every day I get an email from the logwatch program on our company web server. The server is running CentOS 6 and uses Apache, MySQL and PHP to serve web pages. It is a dedicated piece of hardware (not ...
0
votes
1answer
168 views

hacking attempt or something else in IMAP - logwatch logs

In my Logwatch logs I found 3 lines that look weird to me, I speculate that they are hacking attempts. IMAP connect from @ [::ffff:121.183.126.37]DEBUG: Connection, ip=[::ffff:5.102.221.2]: 6 ...
2
votes
0answers
263 views

Why can't I get logwatch to output anything in Ubuntu?

So I installed logwatch using this guide on a Ubuntu 12.04 box. I also setup postfix and my initial intention was to add a daily cronjob to email me these reports (I have the same setup on a Debian ...
1
vote
1answer
1k views

What does this kernel error mean and how should I respond?

The following except is taken from the logwatch of a production LAMP web server I'm about to inherit. It is a dedicated Dell server running CentOS 5 with RAID 1 across two 1TB drives. I have little ...
1
vote
0answers
98 views

How to Use Logwatch With JBoss Logs

I'm successfully using Logwatch for Tomcat and Apache but not for JBoss. For some reason Logwatch can not access any files under the JBoss directory. Is there anything I can do to make this work? ...
1
vote
2answers
921 views

Change the sender email of logwatch on RH Linux

Im running logwatch on red hat 7 it sends mails using root@localhost.localdomain however, the email from localhost.localdomain is not received at the recipient because localhost.localdomain is not ...
0
votes
1answer
171 views

What do these kernel errors in my logwatch mean?

I was reading my logwatch this morning and I've noticed that there are a lot of kernel errors. I'm on CentOS 6 and the machine acts as a web server. Can anyone help me understand what these mean and ...
1
vote
1answer
2k views

Enable & Disable Log-watch feature in Linux server [closed]

Can anyone please share the procedure how to enable & disable the log-watch feature in Linux RHEL 5 machine. Thanks in advance.
2
votes
1answer
577 views

Error from logwatch while sending mail with ssmtp to SES

I'm running a server on AWS (ubuntu) and I need outgoing email to be able to email log files. To do this I'm using ssmtp and amazon's SES (Simple Email Service). I have the email addresses verified ...
0
votes
0answers
1k views

Logwatch configured for nginx with custom log format gives empty output

Problem I have configured logwatch (CentOS 5.8, x64) to include nginx, using this as a guideline and using the Apache and nginx documentation on log formats. The problem is, that I'm using a specific ...
1
vote
1answer
241 views

Make logwatch reports more interesting?

Is it possible to improve the quality of reports from logwatch? Like make it not just report disk usage which doesn't even change much in daily operation, but report significant changes in usage or ...
2
votes
2answers
739 views

How to set up Logwatch to receive high level messages immediately?

I have set up Logwatch on my (Debian) system. Mailing etc works well. What I would like to is to get a daily report of the system once a day And; To receive any high level (failed login attempts, ...
2
votes
0answers
167 views

Analyse of logwatch and aide file

We have both logwatch and aide file. We would like to know how to know if there any intrusion have had taken place as this server was not active for some time. We quite a number of this entries in the ...
5
votes
3answers
2k views

Cannot run logwatch due to Date::Manip issue

I tried to run logwatch at follows [root@machine cron.daily]# ./0logwatch ERROR: Date::Manip unable to determine TimeZone. Execute the following command in a shell prompt: perldoc ...
1
vote
2answers
103 views

Collating cron output for periodic e-mails

vixie-cron e-mails me the output of cron jobs, with one message per job. I would rather receive messages in batches, with either a configurable number of messages per batch or (better) each batch ...
0
votes
2answers
640 views

logwatch - installing without postfix dependency

I want to install logwatch but configure it to use SendEmail (smpt authentication sender) instead of postfix. I don't need full blown mail server, I figure I can use google smtp. I checked ...
0
votes
1answer
300 views

strange Postfix logwatch log summary on my ubuntu vps [closed]

Hi I would be very thankful if someone could help me on explaining this logwatch summary of my postfix installation on my ubuntu 10.04 vps. I dont really know if this might be a normal log file ...
2
votes
1answer
240 views

Suppress log messages about minor 3ware disk temperature changes on CentOS?

I have a number of CentOS 5 servers which use 3ware RAID controllers. These servers are bugging my team with messages about minor temperature changes, like this: Jun 8 12:32:39 HOST smartd[1231]: ...
2
votes
1answer
1k views

How should I setup email log notifications on Debian server

I've built lots of Debian servers. They hardly ever fail but when they do I've never had a good enough logging system. So I told myself this time would be different. I've got Apache2 and MySQL happy ...
1
vote
1answer
782 views

/var/cache/logwatch No such file or directory at /usr/sbin/logwatch line 633

Logwatch has been working perfectly until now. I read a tutorial that you shouldnt edit the config in the default place /usr/share/logwatch Instead you should move it to /etc/logwatch So i did ...
0
votes
1answer
1k views

Logwatch httpd - hacks and probes

Sometimes in my daily logwatch report, I notice that there is a section under httpd for "attempts to use known hacks..." and another section about how many sites probed the server. I have a few ...
8
votes
1answer
2k views

Empty/Null Apache request entries in access log

This entry got logged in a Apache access log: IP ADDRESS - - [00/00/0000:00:00:00 -0000] " " 301 - "-" "-" It was detected by LogWatch as a null HTTP Response and also got marked as a successful ...
0
votes
2answers
716 views

Logwatch Unmatched Entries for named connection refused resolving

Using the default setup of Logwatch on RHEL 6 and the caching name server (BIND 9) package, my daily logwatch reports are filled with unmatched entries regarding DNS server errors. What do I need to ...
1
vote
1answer
250 views

Logwatch not including one host in report. Why?

As the title says, I've setup a central RHEL rsyslog server with a couple of RHEL clients forwarding all their logs to it. The logs are being forwarded correctly because when I look at the content of ...
4
votes
4answers
750 views

How to prevent bots from trying to guess a link on my site

My logwatch report which I installed recently shows me this: --------------------- httpd Begin ------------------------ 0.78 MB transferred in 5864 responses (1xx 0, 2xx 4900, 3xx 0, 4xx 964, 5xx 0) ...
0
votes
2answers
614 views

Add drive to Logwatch disk space check

I'm looking to add a LVM volume to a Logwatch report for a Xen dom0. Currently this LVM volume doesn't show in the report as it is not mounted on the machine but is a physical drive. Any ideas on how ...
1
vote
1answer
371 views

Apache logs on Debian GNU/Linux shows windows executable files

I use logwatch to watch my server logs. It shows this in httpd log section: 19033 Windows executable files (502.53 MB) This is a Debian GNU/Linux server. So it shouldn't be any Windows executables. ...
0
votes
1answer
2k views

Meaning of “SFTP subsystem requests”

The following message showed up in my logwatch: --------------------- SSHD Begin ------------------------ SFTP subsystem requests: 1 Time(s) ---------------------- SSHD End ...
5
votes
5answers
234 views

How should I deal with logs before they get to big?

I found out my disk was full today, and I freed up 10% just from deleting mostly logs from multiple websites. I, personally, like to keep logs as an archive, because I may need to look back on them ...
1
vote
2answers
354 views

Logwatch Disk Space Usage is Wrong/Stale

I have a RHEL 5 server that recently ran out of disk space and now our Logwatch for the server reports the following disk usage (I think this is the last accurate night before the /var partition ...
1
vote
1answer
5k views

What does “Mail Deferred:” mean in Linux Logwatch

I am just analyzing my logwatch logs, and I see the following entries: SMTP SESSION, MESSAGE, OR RECIPIENT ERRORS ------------------------------------------ Mail Rejected: Total: 6 Mail ...
11
votes
4answers
10k views

Linux: logwatch(8) is too noisy. How can I control the noise level?

Our Linux systems run logwatch(8) utility by default. On a RedHat/CentOS/SL system, Logwatch is called by the /etc/cron.daily/ cronjob, which then sends a daily email with the results. These emails ...
0
votes
1answer
176 views

Logwatch: sendmail - sent/received?

Is it possible to get # of sent emails using logwatch? With our current setup I can see the number of received emails using 'logwatch --service sendmail -detail=11' but not the # sent. I can probably ...
2
votes
1answer
2k views

Logwatch: connection attempts using mod_proxy

Today I noticed this entry in my log file: Connection attempts using mod_proxy: 175.180.113.83 -> 66.135.210.61:80: 1 Time(s) This is something I do not normally see in my logs. I have a few ...
1
vote
2answers
2k views

How to change “sender:” field in the header of Logwatch emails

I changed MailFrom="" in /usr/share/logwatch/default.conf/logwatch.conf That altered "From:" in the headers, but "Sender:" is still "root@ip-xx-xx-xx-xx.domain" EC2 Linux AMI beta, Postfix is the ...
0
votes
2answers
1k views

Logwatch: Ignore certain IPs for SSH & PAM checks?

I have a CentOS 5.6 system, which runs Logwatch. If I perform a security scan (Nessus) against this host, it produces unnecessary noise in the Logwatch output. I'd like to run these security scans ...
2
votes
1answer
624 views

Via logwatch, I get messages that root is opening sessions “-> nobody”. Is this a security concern, or normal operation?

Here are some lines from logwatch: pam_unix sshd: Authentication Failures: root (211.167.103.115): 5 Time(s) unknown (219.239.110.139): 1 Time(s) Invalid Users: Unknown Account: 1 ...
1
vote
2answers
316 views

Logwatch: domain running Google Apps mail doesn't recieve logs

Here's an odd problem. I've set up logwatch (ubuntu server) to send email to info@example.com which is running google apps email. But I'm not receiving any logwatch emails. However, if I try logwatch ...
2
votes
1answer
427 views

Logwatch without MTA/Postfix?

Is it possible to have Logwatch send daily emails without actually installing Postfix? I want to keep my server light and installing an MTA just because of Logwatch seems overkill. Or will I need ...
0
votes
2answers
1k views

CentOS Cron running at wrong time, 5hrs late (Logwatch)

Server: CentOS 5.2 with Logwatch 7.3-8.el5 I have a cronjob setup to run logwatch at 10:45pm daily. The cron runs and I get the logwatch email, but it's running at 4:30am. My server's time is behind ...
0
votes
1answer
645 views

Logwatch not showing FTP (Proftpd) success or failed logins, only shows uploades/downloads

Server: CentOS 5.2, Proftpd 1.3.3d, Logwatch 7.3-8.el5.noarch (updated with yum). I've just setup Logwatch and got the email output, it does show some FTP info for example it shows uploaded and ...
0
votes
1answer
632 views

How to set up logwatch for OS X Server

Logwatch is easy enough to install via Macports, and it seems to work but the amount of output it gives leaves something to be desired. For example, this server is primarily a Samba file server, but ...