Skip to main content

Questions tagged [logwatch]

Logwatch is a tool that will monitor your server's logs and email the administrator a digest on a daily basis, and is primarily used on Linux-based distros.

Filter by
Sorted by
Tagged with
2 votes
1 answer
76 views

How to make logwatch show a reboot event in the report?

Our environment consists of several workstations and servers, all RHEL (CentOS 7) and with logwatch (currently v7.4.0) installed. A custom cron job sends daily logwatch reports via email. The command ...
egeiter's user avatar
  • 21
1 vote
0 answers
225 views

How to monitor specific NGINX error codes with Logwatch

I've just started implementing NGINX rate limiting, and need to monitor when rate limiting is actually happening on a server. I found out Logwatch will send daily logs by email which sounds perfect. ...
Kit Johnson's user avatar
2 votes
1 answer
145 views

What is this possible Apache exploit, and am I affected?

I had this warning in my daily logwatch digest this morning: A total of 1 possible successful probes were detected (the following URLs contain strings that match one or more of a listing of strings ...
Darren's user avatar
  • 331
0 votes
1 answer
647 views

Change logwatch cron's hour [closed]

I installed Logwatch with this command: yum install logwatch Always send me logs at 3:00 server hour (I not configured this hour), how can I change cron's hour?. Because at this moment my server is ...
MindServer's user avatar
2 votes
1 answer
230 views

http logfile filter is not shown on report

I'm on debian 10.4 and I've a fresh installation of logwatch. Everything works as expected except logwatch (ver. 7.5.0) that output everything except http logs report. I ran logwatch with --debug med ...
Francesco Piraneo G.'s user avatar
1 vote
1 answer
319 views

Logwatch - Several Attacks? I'm Worried! What should I do?

I have a VPS and I get everyday a super crowded Logwatch. I'm not expert about Debian so I don't know if this is normal or if I should worry. Any opinions? ################### Logwatch 7.4.0 (03/...
Gianluca Della Porta's user avatar
1 vote
2 answers
711 views

Logwatch Emails marked as spam; how to stop reverse DNS on bot hosts?

Is there a way to alter the Logwatch settings such that it stops performing reverse dns name resolution on all the hosts which tried to probe the server or were blocked? These URLs are causing the ...
RedScourge's user avatar
0 votes
1 answer
521 views

Logwatch does not report on httpd (apache2)

Problem: I'm using Debian GNU/Linux 8 and my Logwatch does not have a "Begin httpd" section at all for my Apache pools. /usr/share/logwatch/default.conf/logfiles/http.conf is set for some custom ...
CharlesM's user avatar
  • 101
1 vote
0 answers
390 views

Configure logwatch on CentOS 7 with apache httpd behind CloudFlare

How do I get logwatch to output the IP addresses that probe my http server? It does not seem to output IP addresses although they are shown in the apache logs. ################### Logwatch 7.4.0 (03/...
Nick M's user avatar
  • 121
3 votes
3 answers
4k views

What Exactly Do These "Kernel Audit" Entries in Logwatch Report Mean?

I am using Debian with Logwatch installed. I would receive some strange log records on a regular basis. I searched multiple times regarding the actual meaning of the following entries but still, I ...
user avatar
2 votes
2 answers
382 views

configuration of logwatch: remove from "known attacks" & "probed the server"

I rely on logwatch to get infos about my production servers. Unfortunately two sections provide to much information: Attempts to use known hacks by 656 hosts were logged 1796 time(s) from: xxx....
caliph's user avatar
  • 213
3 votes
2 answers
3k views

LogWatch SMTP auth

So I've been using LogWatch for a little while and wanted to customize it a bit, so this is one of the things I want to edit. I want LogWatch to verify via SMTP? My mailserver (iREDmail) has some ...
Folkmann's user avatar
  • 170
0 votes
2 answers
365 views

How do I remove ^null$ errors from Logwatch?

After the site is migrated to HTTPS, ^null$-errors are displayed in Logwatch (the connection is closed until the server receives a response) for all hosts that access the site. How can I remove this ...
Dmitrii Maslennikov's user avatar
2 votes
0 answers
278 views

Enabling logwatch to log successful requests as well

I have a very low-volume http server (Nginx) which is used by only a few users and otherwise receives some probes from hackers. For this installation I would like the logwatch output to include ...
centic's user avatar
  • 221
1 vote
1 answer
519 views

What does this entry "smtp_stream_setup" in my postfix log mean?

My logwatch shows me every day lots of these messages from my postfix log. Can anyone explain what it means? 1 Jan 2 14:01:50 interface postfix/smtpd[21465]: smtp_stream_setup: maxtime=300 ...
fabianmoronzirfas's user avatar
1 vote
0 answers
342 views

Logwatch for multiple log 'root directories' on a central log server?

I have multiple clusters, each with a service machine that also collects all the logs (rsyslog and RELP). I started separating them to /data/logs/<hostname>/* so the messages, maillog and other ...
Ira's user avatar
  • 139
8 votes
3 answers
5k views

Logwatch is not respecting MailFrom

I've gone through today to setup Logwatch on my server and have installed this all successfully. I've followed this guide on Digital Ocean and set the MailFrom parameter to: MailFrom = mailer@...
James's user avatar
  • 345
0 votes
1 answer
1k views

How to get logwatch to filter dates in celery logs?

I'm a newbie to Logwatch and have it set up to watch log files created by celery, a distributed task queue popular in the Python world. My logwatch.conf "Range" is set to "between yesterday 4am and ...
Ghopper21's user avatar
  • 113
0 votes
2 answers
1k views

Why is my logwatch conf with absolute paths LogFile entries not working?

The logwatch documentation says the LogFile command can handle absolute paths. Accordingly, I have a celery.conf file in /etc/logwatch/conf/services as follows: Title = "Watchdog Celery worker errors"...
Ghopper21's user avatar
  • 113
2 votes
1 answer
2k views

Logwatch postfix report. Where does this "Deferrals" come from and how to stop it?

I'm using logwatch to monitor the logs on my server and I'm trying to make sense out of the postfix report. (See the report below.) By looking at /var/log/mail.log I saw that this mail seems to be ...
fabianmoronzirfas's user avatar
0 votes
0 answers
362 views

Logwatch httpd - Lot of probes

Recently Logwatch detects much more probes on my server than usual. Here an example of my yesterday logwatch report: --------------------- httpd Begin ------------------------ A total of **10415** ...
MadMass's user avatar
1 vote
1 answer
269 views

Configure logwatch to only email when there is something to report

Is there a way to get logwatch, instead of always sending a daily report, to only email a report when there is a problem, i.e. the filtered logs aren't empty?
Ghopper21's user avatar
  • 113
0 votes
0 answers
514 views

Installed, purged, then re-installed logwatch, now getting missing /var/cache/logwatch error

On Ubuntu 12.04, I installed logwatch via sudo apt-get install logwatch Worked great. I made some changes to the shared conf, then realized it was better to leave those alone and override then via /...
Ghopper21's user avatar
  • 113
2 votes
1 answer
745 views

Logwatch clam-update warnings

In Debian Linux stable version, there is always lag between current and stable version. Thus one of packages Clamav is very noisy about this, and log files are full of: WARNING: Your ClamAV ...
Arunas Bart's user avatar
0 votes
1 answer
1k views

How can I modify the disk space output of Logwatch?

I've got logwatch sending me reports every day and part of that report is a disk space analysis. I was wondering how I could modify the disk space script to put emphasis on disks that are greater than ...
nopcorn's user avatar
  • 373
0 votes
1 answer
722 views

Prevent empty apache requests in access.log

In my access.log file I found a hundreds of lines of empty request like this mydomain.com:80 [ip-address] - - [02/Jul/2014:09:11:20 -0500] "GET / HTTP/1.0" 200 25491 "-" "-" mydomain.com:80 [ip-...
dav's user avatar
  • 255
0 votes
1 answer
550 views

logwatch on Centos 6.4

My logwatch is configured correctly and is working correctly when I issue manually /usr/sbin/logwatch I added it to root's crontab and it is listed correctly when I make crontab -l which gives: 0 5 ...
mmonem's user avatar
  • 209
0 votes
1 answer
650 views

Cannot close Port 25 after installing postfix

Before installing logwatch (which installs postfix) on Ubuntu 12.04, the port 25 is blocked by iptables/csf PORT STATE SERVICE 25/tcp filtered smtp After installing logwatch (which installs ...
Nyxynyx's user avatar
  • 1,479
0 votes
1 answer
1k views

monitor rsnapshot's log file with logwatch [closed]

How does one go about including rsnapshot's log file in logwatch's configuration? Logwatch is software that will parse logs and check for important information and email it to someone. How can one ...
d-_-b's user avatar
  • 1,124
0 votes
1 answer
579 views

How to retrieve all the system mails like LogWatch

Hi if you have a handful of servers around each with LogWatch installed and generating a daily summary mail for you, how do you retrieve these mails? At the moment I only have Dovecot installed on ...
user192702's user avatar
48 votes
3 answers
61k views

What does "Normal Shutdown, Thank you for playing [preauth]" In SSH logs mean?

Recently, My SSH log summaries for my Ubuntu 12.04 servers in Logwatch have started showing entries for "11: Normal Shutdown, Thank you for playing [preauth]" along with the "11: Bye Bye [preauth]" ...
Dave Stern's user avatar
0 votes
1 answer
56 views

Are these disk errors cause for concern?

Every day I get an email from the logwatch program on our company web server. The server is running CentOS 6 and uses Apache, MySQL and PHP to serve web pages. It is a dedicated piece of hardware (not ...
GhostInTheSecureShell's user avatar
0 votes
1 answer
440 views

hacking attempt or something else in IMAP - logwatch logs

In my Logwatch logs I found 3 lines that look weird to me, I speculate that they are hacking attempts. IMAP connect from @ [::ffff:121.183.126.37]DEBUG: Connection, ip=[::ffff:5.102.221.2]: 6 Time(...
Jack Deeds's user avatar
3 votes
0 answers
1k views

Why can't I get logwatch to output anything in Ubuntu?

So I installed logwatch using this guide on a Ubuntu 12.04 box. I also setup postfix and my initial intention was to add a daily cronjob to email me these reports (I have the same setup on a Debian ...
c00kiemonster's user avatar
3 votes
1 answer
6k views

What does this kernel error mean and how should I respond?

The following except is taken from the logwatch of a production LAMP web server I'm about to inherit. It is a dedicated Dell server running CentOS 5 with RAID 1 across two 1TB drives. I have little ...
GhostInTheSecureShell's user avatar
1 vote
1 answer
400 views

How to Use Logwatch With JBoss Logs

I'm successfully using Logwatch for Tomcat and Apache but not for JBoss. For some reason Logwatch can not access any files under the JBoss directory. Is there anything I can do to make this work? I'...
Mike T's user avatar
  • 513
1 vote
2 answers
3k views

Change the sender email of logwatch on RH Linux

Im running logwatch on red hat 7 it sends mails using [email protected] however, the email from localhost.localdomain is not received at the recipient because localhost.localdomain is not ...
misamisa's user avatar
0 votes
1 answer
466 views

What do these kernel errors in my logwatch mean?

I was reading my logwatch this morning and I've noticed that there are a lot of kernel errors. I'm on CentOS 6 and the machine acts as a web server. Can anyone help me understand what these mean and ...
GhostInTheSecureShell's user avatar
5 votes
1 answer
16k views

Enable & Disable Log-watch feature in Linux server [closed]

Can anyone please share the procedure how to enable & disable the log-watch feature in Linux RHEL 5 machine. Thanks in advance.
krish's user avatar
  • 69
2 votes
1 answer
2k views

Error from logwatch while sending mail with ssmtp to SES

I'm running a server on AWS (ubuntu) and I need outgoing email to be able to email log files. To do this I'm using ssmtp and amazon's SES (Simple Email Service). I have the email addresses verified ...
Roger Gilbrat's user avatar
1 vote
2 answers
4k views

Logwatch configured for nginx with custom log format gives empty output

Problem I have configured logwatch (CentOS 5.8, x64) to include nginx, using this as a guideline and using the Apache and nginx documentation on log formats. The problem is, that I'm using a specific ...
bartlaarhoven's user avatar
1 vote
1 answer
655 views

Make logwatch reports more interesting?

Is it possible to improve the quality of reports from logwatch? Like make it not just report disk usage which doesn't even change much in daily operation, but report significant changes in usage or ...
Alexander Shcheblikin's user avatar
2 votes
2 answers
1k views

How to set up Logwatch to receive high level messages immediately?

I have set up Logwatch on my (Debian) system. Mailing etc works well. What I would like to is to get a daily report of the system once a day And; To receive any high level (failed login attempts, ...
Phil's user avatar
  • 523
2 votes
1 answer
998 views

Analyse of logwatch and aide file

We have both logwatch and aide file. We would like to know how to know if there any intrusion have had taken place as this server was not active for some time. We quite a number of this entries in the ...
user132638's user avatar
5 votes
3 answers
3k views

Cannot run logwatch due to Date::Manip issue

I tried to run logwatch at follows [root@machine cron.daily]# ./0logwatch ERROR: Date::Manip unable to determine TimeZone. Execute the following command in a shell prompt: perldoc Date::...
Quintin Par's user avatar
  • 4,453
1 vote
2 answers
143 views

Collating cron output for periodic e-mails

vixie-cron e-mails me the output of cron jobs, with one message per job. I would rather receive messages in batches, with either a configurable number of messages per batch or (better) each batch ...
supervacuo's user avatar
  • 1,433
2 votes
2 answers
2k views

logwatch - installing without postfix dependency

I want to install logwatch but configure it to use SendEmail (smpt authentication sender) instead of postfix. I don't need full blown mail server, I figure I can use google smtp. I checked ...
user avatar
0 votes
1 answer
633 views

strange Postfix logwatch log summary on my ubuntu vps [closed]

Hi I would be very thankful if someone could help me on explaining this logwatch summary of my postfix installation on my ubuntu 10.04 vps. I dont really know if this might be a normal log file ...
DannyRe's user avatar
  • 109
2 votes
1 answer
705 views

Suppress log messages about minor 3ware disk temperature changes on CentOS?

I have a number of CentOS 5 servers which use 3ware RAID controllers. These servers are bugging my team with messages about minor temperature changes, like this: Jun 8 12:32:39 HOST smartd[1231]: ...
Stefan Lasiewski's user avatar
2 votes
1 answer
2k views

How should I setup email log notifications on Debian server

I've built lots of Debian servers. They hardly ever fail but when they do I've never had a good enough logging system. So I told myself this time would be different. I've got Apache2 and MySQL happy ...
Gareth's user avatar
  • 8,593