By default, Logwatch is not installed on a CentOS 6 (x64) server (not sure about 32bit versions..?). This is something that I have missed from using the previous versions of CentOS. As a server admin, I like to be able to review this file to see if anything funny or strange has happened over the past day. When trying to install this from yum, I was getting an error:
Error: Package: logwatch-7.3.6-49.el6.noarch
Requires: perl(Date::Manip)
Installing perl(Date::Manip) through the cPanel perl modules interface did not cure the issue. The perl version required by Logwatch is newer than the default cPanel version.
Here is how I corrected the issue and was able to get Logwatch working properly….
The solution is to install Logwatch using the RPM provided by the maintainer. This can be found through sourceforge. Here are the steps used to install the latest version at the time of this posting (logwatch-7.4.0-1.noarch.rpm). You should check the sourceforge site for a later version. Here are the steps needed to install:
First off, open up a terminal and make sure you are logged in as the root user. Next, we need to download the RPM :
root@server [~/downloads]# wget http://downloads.sourceforge.net/project/logwatch/logwatch-7.4.0/logwatch-7.4.0-1.noarch.rpm
Now that we have the RPM, lets go ahead an install it:
root@server [~/downloads]# rpm -Uvh logwatch-7.4.0-1.noarch.rpm
This will create the needed file, and place a linked file in the /etc/cron.daily folder. Now, there are a couple of settings that need to be changed within the Logwatch configuration file. The file is located at /usr/share/logwatch/default.conf/logwatch.conf. Using your text editor open the configuration file and find the following:
Output =
Make sure this is set to “mail”, this will ensure that you get the report emailed to you. This is key, and I have had questions as to why “logwatch is not sending emails though I know that it is running”. It should look like this:
Output = mail
Another setting your should change while in editing the configuration file is the “Detail” of the log. Default is set to low, I prefer high detail, but I suggest that you at least put it to medium detail.
Detail = 10
Here is my full configuration file for reference:
########################################################
# This was written and is maintained by:
# Kirk Bauer <kirk@kaybee.org>
#
# Please send all comments, suggestions, bug reports,
# etc, to kirk@kaybee.org.
#
########################################################
# NOTE:
# All these options are the defaults if you run logwatch with no
# command-line arguments. You can override all of these on the
# command-line.
# You can put comments anywhere you want to. They are effective for the
# rest of the line.
# this is in the format of <name> = <value>. Whitespace at the beginning
# and end of the lines is removed. Whitespace before and after the = sign
# is removed. Everything is case *insensitive*.
# Yes = True = On = 1
# No = False = Off = 0
# Default Log Directory
# All log-files are assumed to be given relative to this directory.
LogDir = /var/log
# You can override the default temp directory (/tmp) here
TmpDir = /var/cache/logwatch
#Output/Format Options
#By default Logwatch will print to stdout in text with no encoding.
#To make email Default set Output = mail to save to file set Output = file
Output = mail
#To make Html the default formatting Format = html
Format = text
#To make Base64 [aka uuencode] Encode = base64
Encode = none
# Default person to mail reports to. Can be a local account or a
# complete email address. Variable Output should be set to mail, or
# --output mail should be passed on command line to enable mail feature.
MailTo = root
# WHen using option --multiemail, it is possible to specify a different
# email recipient per host processed. For example, to send the report
# for hostname host1 to user@example.com, use:
#Mailto_host1 = user@example.com
# Multiple recipients can be specified by separating them with a space.
# Default person to mail reports from. Can be a local account or a
# complete email address.
MailFrom = Logwatch
# if set, the results will be saved in <filename> instead of mailed
# or displayed. Be sure to set Output = file also.
#Filename = /tmp/logwatch
# Use archives? If set to 'Yes', the archives of logfiles
# (i.e. /var/log/messages.1 or /var/log/messages.1.gz) will
# be searched in addition to the /var/log/messages file.
# This usually will not do much if your range is set to just
# 'Yesterday' or 'Today'... it is probably best used with
# By default this is now set to Yes. To turn off Archives uncomment this.
#Archives = No
# Range = All
# The default time range for the report...
# The current choices are All, Today, Yesterday
Range = yesterday
# The default detail level for the report.
# This can either be Low, Med, High or a number.
# Low = 0
# Med = 5
# High = 10
Detail = 10
# The 'Service' option expects either the name of a filter
# (in /usr/share/logwatch/scripts/services/*) or 'All'.
# The default service(s) to report on. This should be left as All for
# most people.
Service = All
# You can also disable certain services (when specifying all)
Service = "-zz-network" # Prevents execution of zz-network service, which
# prints useful network configuration info.
Service = "-zz-sys" # Prevents execution of zz-sys service, which
# prints useful system configuration info.
Service = "-eximstats" # Prevents execution of eximstats service, which
# is a wrapper for the eximstats program.
# If you only cared about FTP messages, you could use these 2 lines
# instead of the above:
#Service = ftpd-messages # Processes ftpd messages in /var/log/messages
#Service = ftpd-xferlog # Processes ftpd messages in /var/log/xferlog
# Maybe you only wanted reports on PAM messages, then you would use:
#Service = pam_pwdb # PAM_pwdb messages - usually quite a bit
#Service = pam # General PAM messages... usually not many
# You can also choose to use the 'LogFile' option. This will cause
# logwatch to only analyze that one logfile.. for example:
#LogFile = messages
# will process /var/log/messages. This will run all the filters that
# process that logfile. This option is probably not too useful to
# most people. Setting 'Service' to 'All' above analyzes all LogFiles
# anyways...
#
# By default we assume that all Unix systems have sendmail or a sendmail-like MTA.
# The mailer code prints a header with To: From: and Subject:.
# At this point you can change the mailer to anything that can handle this output
# stream.
# TODO test variables in the mailer string to see if the To/From/Subject can be set
# From here with out breaking anything. This would allow mail/mailx/nail etc..... -mgt
mailer = "sendmail -t"
#
# With this option set to 'Yes', only log entries for this particular host
# (as returned by 'hostname' command) will be processed. The hostname
# can also be overridden on the commandline (with --hostname option). This
# can allow a log host to process only its own logs, or Logwatch can be
# run once per host included in the logfiles.
#
# The default is to report on all log entries, regardless of its source host.
# Note that some logfiles do not include host information and will not be
# influenced by this setting.
#
#HostLimit = Yes
# vi: shiftwidth=3 tabstop=3 etThat’s it! You should now have a working copy of Logwatch on your server. You should start receiving emails the next time that the daily cron jobs are run. One other note, make sure you have a root forwarder on your server, so that all emails sent to root are forwarded to an email address that you check!
Should you have any problems or questions, please feel free to post them. :)
Chris
If anyone else has this issue, you need to install mailx:
yum install mailxChris
I do as your guide but logwatch doesn’t work
Hello there,
Can you let me know if you are getting any errors at all?
Chris