Logwatch is a tool that will monitor your server's logs and email the administrator a digest on a daily basis, and is primarily used on Linux-based distros.

learn more… | top users | synonyms

11
votes
4answers
9k views

Linux: logwatch(8) is too noisy. How can I control the noise level?

Our Linux systems run logwatch(8) utility by default. On a RedHat/CentOS/SL system, Logwatch is called by the /etc/cron.daily/ cronjob, which then sends a daily email with the results. These emails ...
8
votes
1answer
2k views

Empty/Null Apache request entries in access log

This entry got logged in a Apache access log: IP ADDRESS - - [00/00/0000:00:00:00 -0000] " " 301 - "-" "-" It was detected by LogWatch as a null HTTP Response and also got marked as a successful ...
5
votes
5answers
218 views

How should I deal with logs before they get to big?

I found out my disk was full today, and I freed up 10% just from deleting mostly logs from multiple websites. I, personally, like to keep logs as an archive, because I may need to look back on them ...
5
votes
2answers
3k views

What does “Normal Shutdown, Thank you for playing [preauth]” In SSH logs mean?

Recently, My SSH log summaries for my Ubuntu 12.04 servers in Logwatch have started showing entries for "11: Normal Shutdown, Thank you for playing [preauth]" along with the "11: Bye Bye [preauth]" ...
5
votes
3answers
1k views

Cannot run logwatch due to Date::Manip issue

I tried to run logwatch at follows [root@machine cron.daily]# ./0logwatch ERROR: Date::Manip unable to determine TimeZone. Execute the following command in a shell prompt: perldoc ...
4
votes
4answers
688 views

How to prevent bots from trying to guess a link on my site

My logwatch report which I installed recently shows me this: --------------------- httpd Begin ------------------------ 0.78 MB transferred in 5864 responses (1xx 0, 2xx 4900, 3xx 0, 4xx 964, 5xx 0) ...
4
votes
6answers
2k views

Including hostname in apache logwatch reports

When hosting multiple domains with apache it's useful to see the logwatch apache output with the virtual host name included, but I only get: --------------------- httpd Begin ...
3
votes
2answers
1k views

Centralized logwatch

Logwatch is really useful for me, but I find it really tiresome to watch through all emails. Is there any tool or solution that centralizes all the daily reports into one, and allows to easily ...
3
votes
3answers
791 views

Grouping vsftpd failures using logwatch

I'm trying to compact the syslog entries from vsftpd with logwatch, to get from: vsftpd: pam_succeed_if(vsftpd:auth): error retrieving information about user Administrator vsftpd: ...
2
votes
2answers
645 views

How to set up Logwatch to receive high level messages immediately?

I have set up Logwatch on my (Debian) system. Mailing etc works well. What I would like to is to get a daily report of the system once a day And; To receive any high level (failed login attempts, ...
2
votes
1answer
226 views

Suppress log messages about minor 3ware disk temperature changes on CentOS?

I have a number of CentOS 5 servers which use 3ware RAID controllers. These servers are bugging my team with messages about minor temperature changes, like this: Jun 8 12:32:39 HOST smartd[1231]: ...
2
votes
1answer
573 views

Via logwatch, I get messages that root is opening sessions “-> nobody”. Is this a security concern, or normal operation?

Here are some lines from logwatch: pam_unix sshd: Authentication Failures: root (211.167.103.115): 5 Time(s) unknown (219.239.110.139): 1 Time(s) Invalid Users: Unknown Account: 1 ...
2
votes
2answers
2k views

Using ignore.conf with logwatch

I have added the following to /etc/postfix/header_checks so that postfix will log the subject lines of every email: /^subject: / WARN This produces log entries in /var/log/mail.log like: May 19 ...
2
votes
1answer
969 views

How should I setup email log notifications on Debian server

I've built lots of Debian servers. They hardly ever fail but when they do I've never had a good enough logging system. So I told myself this time would be different. I've got Apache2 and MySQL happy ...
2
votes
1answer
393 views

Logwatch without MTA/Postfix?

Is it possible to have Logwatch send daily emails without actually installing Postfix? I want to keep my server light and installing an MTA just because of Logwatch seems overkill. Or will I need ...
2
votes
1answer
844 views

Is Nagios capable of covering the functionality of Logwatch?

I have decided to adopt Nagios for our infrastructure. We were going to use Logwatch, but after seeing some of the things in Nagios like log rotation I am wondering if Nagios is capable of sending ...
2
votes
1answer
446 views

Error from logwatch while sending mail with ssmtp to SES

I'm running a server on AWS (ubuntu) and I need outgoing email to be able to email log files. To do this I'm using ssmtp and amazon's SES (Simple Email Service). I have the email addresses verified ...
2
votes
0answers
144 views

Analyse of logwatch and aide file

We have both logwatch and aide file. We would like to know how to know if there any intrusion have had taken place as this server was not active for some time. We quite a number of this entries in the ...
1
vote
1answer
632 views

What does this kernel error mean and how should I respond?

The following except is taken from the logwatch of a production LAMP web server I'm about to inherit. It is a dedicated Dell server running CentOS 5 with RAID 1 across two 1TB drives. I have little ...
1
vote
1answer
8k views

How to configure logwatch to monitor a custom log file

Ubuntu Server 9.10 Hi Guys, Could someone point me to some instructions for how to get logwatch to monitor a custom log file? I have a dropbox solution that documents uploads/downloads to a log ...
1
vote
1answer
329 views

Apache logs on Debian GNU/Linux shows windows executable files

I use logwatch to watch my server logs. It shows this in httpd log section: 19033 Windows executable files (502.53 MB) This is a Debian GNU/Linux server. So it shouldn't be any Windows executables. ...
1
vote
1answer
3k views

What does “Mail Deferred:” mean in Linux Logwatch

I am just analyzing my logwatch logs, and I see the following entries: SMTP SESSION, MESSAGE, OR RECIPIENT ERRORS ------------------------------------------ Mail Rejected: Total: 6 Mail ...
1
vote
1answer
194 views

Make logwatch reports more interesting?

Is it possible to improve the quality of reports from logwatch? Like make it not just report disk usage which doesn't even change much in daily operation, but report significant changes in usage or ...
1
vote
1answer
2k views

Logwatch: connection attempts using mod_proxy

Today I noticed this entry in my log file: Connection attempts using mod_proxy: 175.180.113.83 -> 66.135.210.61:80: 1 Time(s) This is something I do not normally see in my logs. I have a few ...
1
vote
2answers
95 views

Collating cron output for periodic e-mails

vixie-cron e-mails me the output of cron jobs, with one message per job. I would rather receive messages in batches, with either a configurable number of messages per batch or (better) each batch ...
1
vote
1answer
606 views

/var/cache/logwatch No such file or directory at /usr/sbin/logwatch line 633

Logwatch has been working perfectly until now. I read a tutorial that you shouldnt edit the config in the default place /usr/share/logwatch Instead you should move it to /etc/logwatch So i did ...
1
vote
2answers
294 views

Logwatch Disk Space Usage is Wrong/Stale

I have a RHEL 5 server that recently ran out of disk space and now our Logwatch for the server reports the following disk usage (I think this is the last accurate night before the /var partition ...
1
vote
1answer
2k views

How to change “sender:” field in the header of Logwatch emails

I changed MailFrom="" in /usr/share/logwatch/default.conf/logwatch.conf That altered "From:" in the headers, but "Sender:" is still "root@ip-xx-xx-xx-xx.domain" EC2 Linux AMI beta, Postfix is the ...
1
vote
3answers
256 views

Logwatch sends me 2 copies of yesterday's server activity, why?

I use Logwatch to track what is going on on one of my Fedora 11 boxes. Since updating it from an older Fedora release I now get 2 copies of the same information to my inbox. I cannot find where this ...
1
vote
0answers
185 views

Why can't I get logwatch to output anything in Ubuntu?

So I installed logwatch using this guide on a Ubuntu 12.04 box. I also setup postfix and my initial intention was to add a daily cronjob to email me these reports (I have the same setup on a Debian ...
1
vote
0answers
61 views

How to Use Logwatch With JBoss Logs

I'm successfully using Logwatch for Tomcat and Apache but not for JBoss. For some reason Logwatch can not access any files under the JBoss directory. Is there anything I can do to make this work? ...
1
vote
1answer
231 views

Logwatch not including one host in report. Why?

As the title says, I've setup a central RHEL rsyslog server with a couple of RHEL clients forwarding all their logs to it. The logs are being forwarded correctly because when I look at the content of ...
1
vote
2answers
294 views

Logwatch: domain running Google Apps mail doesn't recieve logs

Here's an odd problem. I've set up logwatch (ubuntu server) to send email to info@example.com which is running google apps email. But I'm not receiving any logwatch emails. However, if I try logwatch ...
0
votes
2answers
1k views

Logwatch: Ignore certain IPs for SSH & PAM checks?

I have a CentOS 5.6 system, which runs Logwatch. If I perform a security scan (Nessus) against this host, it produces unnecessary noise in the Logwatch output. I'd like to run these security scans ...
0
votes
3answers
407 views

logwatch explanation

Could anyone please explain what the various parts of the following LogWatch mean: --------------------- IMAP Begin ------------------------ [IMAPd] Logout stats: ==================== User | ...
0
votes
1answer
2k views

How can I get logwatch to process alternate apache logs?

CentOS 5 | Apache 2.2.3 | LogWatch 7.3 Hello All, I have Apache running on a CentOS box and am hosting multiple VirtualHosts. Each of these virtual hosts has a separate access log. For example: ...
0
votes
1answer
256 views

strange Postfix logwatch log summary on my ubuntu vps [closed]

Hi I would be very thankful if someone could help me on explaining this logwatch summary of my postfix installation on my ubuntu 10.04 vps. I dont really know if this might be a normal log file ...
0
votes
1answer
1k views

Logwatch httpd - hacks and probes

Sometimes in my daily logwatch report, I notice that there is a section under httpd for "attempts to use known hacks..." and another section about how many sites probed the server. I have a few ...
0
votes
1answer
1k views

Enable & Disable Log-watch feature in Linux server [closed]

Can anyone please share the procedure how to enable & disable the log-watch feature in Linux RHEL 5 machine. Thanks in advance.
0
votes
2answers
527 views

logwatch - installing without postfix dependency

I want to install logwatch but configure it to use SendEmail (smpt authentication sender) instead of postfix. I don't need full blown mail server, I figure I can use google smtp. I checked ...
0
votes
1answer
2k views

Meaning of “SFTP subsystem requests”

The following message showed up in my logwatch: --------------------- SSHD Begin ------------------------ SFTP subsystem requests: 1 Time(s) ---------------------- SSHD End ...
0
votes
2answers
1k views

What is /dev/md2?

Specifically, what might "A Fail event had been detected on md device /dev/md2." ramify? (in an email from Plesk control panel's "Logwatch" BTW)
0
votes
1answer
87 views

Cannot close Port 25 after installing postfix

Before installing logwatch (which installs postfix) on Ubuntu 12.04, the port 25 is blocked by iptables/csf PORT STATE SERVICE 25/tcp filtered smtp After installing logwatch (which installs ...
0
votes
1answer
97 views

How to retrieve all the system mails like LogWatch

Hi if you have a handful of servers around each with LogWatch installed and generating a daily summary mail for you, how do you retrieve these mails? At the moment I only have Dovecot installed on ...
0
votes
1answer
137 views

hacking attempt or something else in IMAP - logwatch logs

In my Logwatch logs I found 3 lines that look weird to me, I speculate that they are hacking attempts. IMAP connect from @ [::ffff:121.183.126.37]DEBUG: Connection, ip=[::ffff:5.102.221.2]: 6 ...
0
votes
1answer
142 views

What do these kernel errors in my logwatch mean?

I was reading my logwatch this morning and I've noticed that there are a lot of kernel errors. I'm on CentOS 6 and the machine acts as a web server. Can anyone help me understand what these mean and ...
0
votes
2answers
510 views

Add drive to Logwatch disk space check

I'm looking to add a LVM volume to a Logwatch report for a Xen dom0. Currently this LVM volume doesn't show in the report as it is not mounted on the machine but is a physical drive. Any ideas on how ...
0
votes
2answers
1k views

CentOS Cron running at wrong time, 5hrs late (Logwatch)

Server: CentOS 5.2 with Logwatch 7.3-8.el5 I have a cronjob setup to run logwatch at 10:45pm daily. The cron runs and I get the logwatch email, but it's running at 4:30am. My server's time is behind ...
0
votes
1answer
574 views

How to set up logwatch for OS X Server

Logwatch is easy enough to install via Macports, and it seems to work but the amount of output it gives leaves something to be desired. For example, this server is primarily a Samba file server, but ...
0
votes
1answer
260 views

get statistics about postfix

I have postfix on my server. and my server is sending about 5K emails daily i need to get some statistics about these emails in web interface (web tool) for example how many of them went to each ...