Questions tagged [logwatch]
Logwatch is a tool that will monitor your server's logs and email the administrator a digest on a daily basis, and is primarily used on Linux-based distros.
86
questions
0
votes
0
answers
30
views
Exim and Logwatch Missing Return-Path
I have been trying to troubleshoot a weird issue I am having with logwatch and exim. I have logwatch setup so send via another exim smarthost.
If I send a test message via GNU mail. It gets through ...
- 1
0
votes
0
answers
48
views
What are "unmatched entries" from rsnapshot in Logwatch?
I've just started using Logwatch and think it's brilliant. But every day I get the following errors from rsnapshot:
**Unmatched Entries**
~/bin/backupscript.sh: 24 Time(s)
cd /backups/: 24 Time(...
- 131
0
votes
0
answers
110
views
How to monitor specific NGINX error codes with Logwatch
I've just started implementing NGINX rate limiting, and need to monitor when rate limiting is actually happening on a server. I found out Logwatch will send daily logs by email which sounds perfect. ...
- 131
2
votes
1
answer
93
views
What is this possible Apache exploit, and am I affected?
I had this warning in my daily logwatch digest this morning:
A total of 1 possible successful probes were detected (the following URLs
contain strings that match one or more of a listing of strings ...
- 331
0
votes
1
answer
477
views
Change logwatch cron's hour [closed]
I installed Logwatch with this command: yum install logwatch
Always send me logs at 3:00 server hour (I not configured this hour), how can I change cron's hour?.
Because at this moment my server is ...
- 39
2
votes
1
answer
189
views
http logfile filter is not shown on report
I'm on debian 10.4 and I've a fresh installation of logwatch. Everything works as expected except logwatch (ver. 7.5.0) that output everything except http logs report.
I ran logwatch with --debug med ...
1
vote
1
answer
271
views
Logwatch - Several Attacks? I'm Worried! What should I do?
I have a VPS and I get everyday a super crowded Logwatch.
I'm not expert about Debian so I don't know if this is normal or if I should worry.
Any opinions?
################### Logwatch 7.4.0 (03/...
1
vote
2
answers
593
views
Logwatch Emails marked as spam; how to stop reverse DNS on bot hosts?
Is there a way to alter the Logwatch settings such that it stops performing reverse dns name resolution on all the hosts which tried to probe the server or were blocked?
These URLs are causing the ...
- 147
0
votes
1
answer
383
views
Logwatch does not report on httpd (apache2)
Problem: I'm using Debian GNU/Linux 8 and my Logwatch does not have a "Begin httpd" section at all for my Apache pools.
/usr/share/logwatch/default.conf/logfiles/http.conf
is set for some custom ...
- 101
1
vote
0
answers
359
views
Configure logwatch on CentOS 7 with apache httpd behind CloudFlare
How do I get logwatch to output the IP addresses that probe my http server? It does not seem to output IP addresses although they are shown in the apache logs.
################### Logwatch 7.4.0 (03/...
- 121
3
votes
3
answers
3k
views
What Exactly Do These "Kernel Audit" Entries in Logwatch Report Mean?
I am using Debian with Logwatch installed. I would receive some strange log records on a regular basis. I searched multiple times regarding the actual meaning of the following entries but still, I ...
user411672
2
votes
1
answer
342
views
configuration of logwatch: remove from "known attacks" & "probed the server"
I rely on logwatch to get infos about my production servers.
Unfortunately two sections provide to much information:
Attempts to use known hacks by 656 hosts were logged 1796 time(s)
from:
xxx....
- 203
2
votes
2
answers
2k
views
LogWatch SMTP auth
So I've been using LogWatch for a little while and wanted to customize it a bit, so this is one of the things I want to edit.
I want LogWatch to verify via SMTP?
My mailserver (iREDmail) has some ...
- 160
0
votes
2
answers
322
views
How do I remove ^null$ errors from Logwatch?
After the site is migrated to HTTPS, ^null$-errors are displayed in Logwatch (the connection is closed until the server receives a response) for all hosts that access the site.
How can I remove this ...
2
votes
0
answers
255
views
Enabling logwatch to log successful requests as well
I have a very low-volume http server (Nginx) which is used by only a few users and otherwise receives some probes from hackers.
For this installation I would like the logwatch output to include ...
- 221
1
vote
1
answer
458
views
What does this entry "smtp_stream_setup" in my postfix log mean?
My logwatch shows me every day lots of these messages from my postfix log. Can anyone explain what it means?
1 Jan 2 14:01:50 interface postfix/smtpd[21465]: smtp_stream_setup: maxtime=300 ...
1
vote
0
answers
311
views
Logwatch for multiple log 'root directories' on a central log server?
I have multiple clusters, each with a service machine that also collects all the logs (rsyslog and RELP). I started separating them to /data/logs/<hostname>/* so the messages, maillog and other ...
- 139
8
votes
3
answers
4k
views
Logwatch is not respecting MailFrom
I've gone through today to setup Logwatch on my server and have installed this all successfully.
I've followed this guide on Digital Ocean and set the MailFrom parameter to:
MailFrom = mailer@...
- 345
0
votes
1
answer
994
views
How to get logwatch to filter dates in celery logs?
I'm a newbie to Logwatch and have it set up to watch log files created by celery, a distributed task queue popular in the Python world.
My logwatch.conf "Range" is set to "between yesterday 4am and ...
- 113
0
votes
1
answer
1k
views
Why is my logwatch conf with absolute paths LogFile entries not working?
The logwatch documentation says the LogFile command can handle absolute paths. Accordingly, I have a celery.conf file in /etc/logwatch/conf/services as follows:
Title = "Watchdog Celery worker errors"...
- 113
2
votes
1
answer
2k
views
Logwatch postfix report. Where does this "Deferrals" come from and how to stop it?
I'm using logwatch to monitor the logs on my server and I'm trying to make sense out of the postfix report. (See the report below.)
By looking at /var/log/mail.log I saw that this mail seems to be ...
0
votes
0
answers
336
views
Logwatch httpd - Lot of probes
Recently Logwatch detects much more probes on my server than usual. Here an example of my yesterday logwatch report:
--------------------- httpd Begin ------------------------
A total of **10415** ...
- 1
1
vote
1
answer
227
views
Configure logwatch to only email when there is something to report
Is there a way to get logwatch, instead of always sending a daily report, to only email a report when there is a problem, i.e. the filtered logs aren't empty?
- 113
0
votes
0
answers
490
views
Installed, purged, then re-installed logwatch, now getting missing /var/cache/logwatch error
On Ubuntu 12.04, I installed logwatch via
sudo apt-get install logwatch
Worked great. I made some changes to the shared conf, then realized it was better to leave those alone and override then via /...
- 113
2
votes
1
answer
695
views
Logwatch clam-update warnings
In Debian Linux stable version, there is always lag between current and stable version.
Thus one of packages Clamav is very noisy about this, and log files are full of:
WARNING: Your ClamAV ...
- 699
0
votes
1
answer
1k
views
How can I modify the disk space output of Logwatch?
I've got logwatch sending me reports every day and part of that report is a disk space analysis. I was wondering how I could modify the disk space script to put emphasis on disks that are greater than ...
- 363
0
votes
1
answer
672
views
Prevent empty apache requests in access.log
In my access.log file I found a hundreds of lines of empty request like this
mydomain.com:80 [ip-address] - - [02/Jul/2014:09:11:20 -0500] "GET / HTTP/1.0" 200 25491 "-" "-"
mydomain.com:80 [ip-...
- 255
0
votes
1
answer
545
views
logwatch on Centos 6.4
My logwatch is configured correctly and is working correctly when I issue manually
/usr/sbin/logwatch
I added it to root's crontab and it is listed correctly when I make crontab -l which gives:
0 5 ...
- 209
0
votes
1
answer
631
views
Cannot close Port 25 after installing postfix
Before installing logwatch (which installs postfix) on Ubuntu 12.04, the port 25 is blocked by iptables/csf
PORT STATE SERVICE
25/tcp filtered smtp
After installing logwatch (which installs ...
- 1,459
0
votes
1
answer
1k
views
monitor rsnapshot's log file with logwatch [closed]
How does one go about including rsnapshot's log file in logwatch's configuration?
Logwatch is software that will parse logs and check for important information and email it to someone. How can one ...
- 1,124
0
votes
1
answer
563
views
How to retrieve all the system mails like LogWatch
Hi if you have a handful of servers around each with LogWatch installed and generating a daily summary mail for you, how do you retrieve these mails?
At the moment I only have Dovecot installed on ...
- 931
48
votes
3
answers
60k
views
What does "Normal Shutdown, Thank you for playing [preauth]" In SSH logs mean?
Recently, My SSH log summaries for my Ubuntu 12.04 servers in Logwatch have started showing entries for "11: Normal Shutdown, Thank you for playing [preauth]" along with the "11: Bye Bye [preauth]" ...
- 605
0
votes
1
answer
54
views
Are these disk errors cause for concern?
Every day I get an email from the logwatch program on our company web server. The server is running CentOS 6 and uses Apache, MySQL and PHP to serve web pages. It is a dedicated piece of hardware (not ...
0
votes
1
answer
421
views
hacking attempt or something else in IMAP - logwatch logs
In my Logwatch logs I found 3 lines that look weird to me, I speculate that they are hacking attempts.
IMAP connect from @ [::ffff:121.183.126.37]DEBUG: Connection, ip=[::ffff:5.102.221.2]: 6 Time(...
3
votes
0
answers
1k
views
Why can't I get logwatch to output anything in Ubuntu?
So I installed logwatch using this guide on a Ubuntu 12.04 box. I also setup postfix and my initial intention was to add a daily cronjob to email me these reports (I have the same setup on a Debian ...
- 131
3
votes
1
answer
6k
views
What does this kernel error mean and how should I respond?
The following except is taken from the logwatch of a production LAMP web server I'm about to inherit. It is a dedicated Dell server running CentOS 5 with RAID 1 across two 1TB drives.
I have little ...
1
vote
1
answer
381
views
How to Use Logwatch With JBoss Logs
I'm successfully using Logwatch for Tomcat and Apache but not for JBoss. For some reason Logwatch can not access any files under the JBoss directory. Is there anything I can do to make this work? I'...
- 473
1
vote
2
answers
3k
views
Change the sender email of logwatch on RH Linux
Im running logwatch on red hat 7
it sends mails using root@localhost.localdomain
however, the email from localhost.localdomain is not received at the recipient because localhost.localdomain is not ...
- 49
0
votes
1
answer
435
views
What do these kernel errors in my logwatch mean?
I was reading my logwatch this morning and I've noticed that there are a lot of kernel errors. I'm on CentOS 6 and the machine acts as a web server. Can anyone help me understand what these mean and ...
5
votes
1
answer
15k
views
Enable & Disable Log-watch feature in Linux server [closed]
Can anyone please share the procedure how to enable & disable the log-watch feature in Linux RHEL 5 machine.
Thanks in advance.
- 69
2
votes
1
answer
2k
views
Error from logwatch while sending mail with ssmtp to SES
I'm running a server on AWS (ubuntu) and I need outgoing email to be able to email log files. To do this I'm using ssmtp and amazon's SES (Simple Email Service).
I have the email addresses verified ...
- 271
1
vote
2
answers
3k
views
Logwatch configured for nginx with custom log format gives empty output
Problem
I have configured logwatch (CentOS 5.8, x64) to include nginx, using this as a guideline and using the Apache and nginx documentation on log formats. The problem is, that I'm using a specific ...
- 206
1
vote
1
answer
623
views
Make logwatch reports more interesting?
Is it possible to improve the quality of reports from logwatch?
Like make it not just report disk usage which doesn't even change much in daily operation, but report significant changes in usage or ...
2
votes
2
answers
1k
views
How to set up Logwatch to receive high level messages immediately?
I have set up Logwatch on my (Debian) system. Mailing etc works well.
What I would like to is to get a daily report of the system once a day
And;
To receive any high level (failed login attempts, ...
- 523
2
votes
1
answer
930
views
Analyse of logwatch and aide file
We have both logwatch and aide file. We would like to know how to know if there any intrusion have had taken place as this server was not active for some time. We quite a number of this entries in the ...
- 151
5
votes
3
answers
3k
views
Cannot run logwatch due to Date::Manip issue
I tried to run logwatch at follows
[root@machine cron.daily]# ./0logwatch
ERROR: Date::Manip unable to determine TimeZone.
Execute the following command in a shell prompt:
perldoc Date::...
- 4,363
1
vote
2
answers
138
views
Collating cron output for periodic e-mails
vixie-cron e-mails me the output of cron jobs, with one message per job.
I would rather receive messages in batches, with either a configurable number of messages per batch or (better) each batch ...
- 1,433
2
votes
2
answers
2k
views
logwatch - installing without postfix dependency
I want to install logwatch but configure it to use SendEmail (smpt authentication sender) instead of postfix. I don't need full blown mail server, I figure I can use google smtp.
I checked ...
user113400
0
votes
1
answer
624
views
strange Postfix logwatch log summary on my ubuntu vps [closed]
Hi I would be very thankful if someone could help me on explaining this logwatch summary of my postfix installation on my ubuntu 10.04 vps. I dont really know if this might be a normal log file ...
- 109
2
votes
1
answer
643
views
Suppress log messages about minor 3ware disk temperature changes on CentOS?
I have a number of CentOS 5 servers which use 3ware RAID controllers.
These servers are bugging my team with messages about minor temperature changes, like this:
Jun 8 12:32:39 HOST smartd[1231]: ...
- 23.6k