Home / server / Questions

Questions[logwatch](server)

Martin Hope
h00j
Asked: 2012-05-24 01:46:12 +0800 CST
  • 5

Logwatch has been working perfectly until now. I read a tutorial that you shouldnt edit the config in the default place

/usr/share/logwatch

Instead you should move it to /etc/logwatch

So i did that and now i get this error

/var/cache/logwatch No such file or directory at /usr/sbin/logwatch line 633.

Does anyone know how to fix? Or should i just try removing the entry in /etc ?

debian logwatch
Martin Hope
elle
Asked: 2012-05-05 08:36:48 +0800 CST
  • 10

This entry got logged in a Apache access log:

IP ADDRESS - - [00/00/0000:00:00:00 -0000] " " 301 - "-" "-"

It was detected by LogWatch as a null HTTP Response and also got marked as a successful probe..

I am curious about how this request about made and how it is considered a successful probe. Here is what I can decipher with specific questions:

  1. Their request was " " - what does this mean?
  2. HTTP return code was 301: this website has a redirect defined in the Apache config - perhaps they were hitting the URL which triggers this redirect?
  3. They were not using a proper HTTP request
  4. They got "-" size return back - what does this mean?
logging apache-2.2 logwatch 301-redirect
Martin Hope
Stefan Lasiewski
Asked: 2011-07-23 15:24:00 +0800 CST
  • 32

Our Linux systems run logwatch(8) utility by default. On a RedHat/CentOS/SL system, Logwatch is called by the /etc/cron.daily/ cronjob, which then sends a daily email with the results. These emails have a subject like:

Subject: Logwatch for $HOSTNAME

The problem is that by default these daily emails are too noisy and contain a lot of superfluous information (HTTP errors, daily disk usage, etc) which are already monitored by other services (Nagios, Cacti, central syslog, etc). For 100 systems, the email load is unbearable. People ignore the emails, which means that we may miss problems which are picked up by logwatch.

How can I reduce the amount of noise generated by logwatch, but still use logwatch to notify us of significant problems?

I'll post my own answer below, but I would like to see what others have done.

Note: I have a similar question regarding FreeBSD, at FreeBSD: periodic(8) is too noisy. How can I control the noise level?

linux monitoring syslog logwatch
Martin Hope
Robert Munteanu
Asked: 2009-06-13 00:03:23 +0800 CST
  • 6

When hosting multiple domains with apache it's useful to see the logwatch apache output with the virtual host name included, but I only get:

 --------------------- httpd Begin ------------------------

 Requests with error response codes
   400 Bad Request
      /: 1 Time(s)
      /robots.txt: 1 Time(s)

whereas I would like something like

 --------------------- httpd Begin ------------------------

 Requests with error response codes
   400 Bad Request
      example.com/: 1 Time(s)
      example.org/robots.txt: 1 Time(s)

How can I achieve this with logwatch?

apache-2.2 logwatch