Tagged: logwatch

Logwatch Template

I use logwatch in almost all the places. So, here is a little piece of template that I use all the time. A little explanation, though. Whenever I setup a new server, I setup a daily logwatch. Once, the server becomes stable, I move it to weekly logwatch. So, during the transition period, it is just a matter of commenting out certain lines and un-commenting certain other lines. Anyway, here, we go…

# global / common directives
MailFrom = logwatch@pothi.inc
MailTo = pothi@mailemaildomain.com

# Un-comment the following two lines, to enable weekly logwatch
# Range = between -7 days and -1 days
# Subject = "Weekly Log from Pothi Inc"

# Comment out the following two lines, to disable nightly logwatch
Subject = "Nightly Log from Pothi Inc"
Detail = High


Logwatch – Change Subject – Amazon AMI

Amazon AMI, until 2013.03 uses, Logwatch version 7.3.6 that was released on 05/19/07 . That was very old. It doesn’t support letting us customize the subject line either. So, here is the trick

– Edit /usr/share/logwatch/scripts/logwatch.pl

– Search for the line that starts with ‘print OUTFILE’

– Replace that line with the following (copied from the latest version of this scripts)

#If $Config{'subject'} exists lets use it.
#This does not allow for variable expansion as the default below does -mgt
if ($Config{'subject'}) {
    print OUTFILE "Subject: $Config{'subject'}\n";
} else {
    print OUTFILE "Subject: Logwatch for $Config{'hostname'} (${OStitle})\n";

– Now, execute /etc/cron.daily/0logwatch