Product docs and API reference are now on Akamai TechDocs.
Search product docs.
Search for “” in product docs.
Search API reference.
Search for “” in API reference.
Search Results
 results matching 
 results
No Results
Filters
Monitor System Logs with Logwatch
Traducciones al EspañolEstamos traduciendo nuestros guías y tutoriales al Español. Es posible que usted esté viendo una traducción generada automáticamente. Estamos trabajando con traductores profesionales para verificar las traducciones de nuestro sitio web. Este proyecto es un trabajo en curso.
Logwatch is a log parsing program that analyzes and generates daily reports on your system’s log activity. Logwatch does not provide real time alerts, but instead creates a digest organized by systems for ease of review. More advanced users can also pair Logwatch with custom analysis scripts to fine-tune their reports.
By default, Logwatch uses Sendmail to send digests.
su
into root. For more information on privileges see our Users and Groups
guide.Install Logwatch and Sendmail
Ubuntu
Update your system:
sudo apt update && sudo apt upgrade
Install Logwatch and Sendmail:
sudo apt install logwatch sendmail
Debian
Update your system:
sudo apt update && sudo apt upgrade
Install Logwatch and Sendmail:
sudo apt install logwatch sendmail-bin sendmail
CentOS Stream, AlmaLinux, Rocky Linux, and Fedora
Update your system:
sudo dnf update
Install Logwatch and Sendmail:
sudo dnf install logwatch sendmail
Start Sendmail:
sudo systemctl start sendmail
CentOS 7
Update your system:
sudo yum update
Install Logwatch and Sendmail:
sudo yum install logwatch sendmail
Start Sendmail:
sudo systemctl start sendmail
Arch Linux
Update your system:
pacman -Syu
Install Logwatch and Postfix, to replace the default Sendmail, which is not in Arch’s repositories.
pacman -S logwatch postfix
Logwatch will prompt you to select which cron provider to use. Select the default, cronie.
Note Other SMTP clients can also be used for delivering Logwatch messages.Edit the
/etc/postfix/main.cf
file to add your domain information, and allow for send-only mail, replacinghostname.example.com
with your own hostname and domain:- File: /etc/postfix/main.cf
1 2
myhostname = hostname.example.com inet_interfaces = loopback-only
Note Both A/AAAA, and MX records will need to be set for your domain.Edit
/etc/postfix/aliases
to uncommentroot
and alias it toroot@hostname.example.com
, replacinghostname.example.com
with your own hostname and domain:- File: /etc/postfix/aliases
1
root: root@hostname.example.com
Run
newaliases
after editing the aliases list.Start postfix:
systemctl start postfix
Configure Logwatch
The default configuration file for Logwatch is located at /usr/share/logwatch/default.conf/logwatch.conf
. This file contains information on which directories for Logwatch to track, how the digest is output, where the digest is sent to, and which services of which to keep track.
The following settings are the most comment configuration changes that will need to be made. Others can be found in the logwatch.conf
file, explained in the comments.
logwatch.conf
file, change the Details
setting to Med
.Log Directories
By default, Logwatch digests will include all logs contained within /var/log
. If any other directories contain logs, such as website directories, they can be added by including additional LogDir
lines. For example:
- File: /usr/share/logwatch/default.conf/logwatch.conf
1 2
LogDir = /var/log LogDir = /var/www/example.com/logs
Print Logwatch Digest to Console
The default Logwatch configuration will output the digest to your Linode’s console. This is defined with the Output
variable, which is set to stdout
by default. This option is feasible if you are only planning on manually running Logwatch, but does not save or send the logs to you for later perusal.
Email Logwatch Digest
The Logwatch digest can be sent to local users or external email addresses, in plain text or HTML formats.
Prior to sending mail externally or locally ensure you have Sendmail installed on the Linode. If you choose to use a different MTA client, change the mailer
line in the Logwatch configuration file to contain the directory of your chosen MTA, or alias /usr/sbin/sendmail
to your MTA.
If using Arch, and you followed the above install instructions, Sendmail is already aliased to msmtp.
Change the
Output
value tomail
. If you wish to receive the messages in HTML format change theFormat
value tohtml
.Change the
MailTo
address to a valid email address, or local account user. For example, to send mail to theroot
user change the line to read:- File: /usr/share/logwatch/default.conf/logwatch.conf
1
MailTo = root
Change the
MailFrom
value to a valid email address, or to a local user. This can also be left asLogwatch
.
Save Logwatch Digest to File
Logwatch digests can also be saved to a file on your system.
Change the
Output
value tofile
.Find and uncomment (remove the hashmark [#]) the
Filename
value. Set the path and filename in which you wish to save your Logwatch digests.
Run Logwatch
Run Logwatch Manually
Logwatch can be run manually at any time by inputting the logwatch
command to your console. This command can be appended with a number of options to change the default output to suit your needs:
--detail
: Can be set to low, med, high, or any numerical values between 1 and 10. Defines how detailed the report will be.--logdir
: The directory containing the log files you wish to gain reports on.--service
: The service definition that you wish to report on.--output
: How you want the file to be sent: Standard output (stdout
), mail, or file.--format
: Plain text or HTML.--mailto
: The local user or email address to send the report to.
Run Logwatch through Cron
Logwatch often works best when configured to run daily and send or save a report to view later. This can be achieved by setting Logwatch up to run as a cronjob.
Open the crontab:
crontab -e
Add a line for Logwatch. The following code is configured to run at 00:30 each day:
- File: /etc/crontab
1
30 0 * * * /usr/sbin/logwatch
For more information on adjusting your crontab scheduling, reference our guide on Scheduling Tasks with Cron .
This page was originally published on