[Logwatch-Devel] Fwd: Improved configuration hierarchy

Bjorn L. bl_logwatch2 at mblmail.net
Thu Feb 14 22:52:50 MST 2008

[Comments at the end.]

Markus Lude wrote:
> On Thu, Feb 14, 2008 at 10:25:18AM -0800, Mike Tremaine wrote:
>> Kirk Bauer wrote:
>>> Not sure if we want to separate default and dist... but if we weren't
>>> treating all directories equally I think we should.
>>> Unfortunately these days it is all I can do to forward these to the
>>> list, I'm not doing as much pre-screening as I normally do.  Hopefully
>>> this is a useful patch.
>>> ---------- Forwarded message ----------
>>> From: Chris O'Regan <chris at encs.concordia.ca>
>>> Date: Tue, Feb 12, 2008 at 3:40 PM
>>> Subject: Improved configuration hierarchy
>>> To: logwatch-patches at logwatch.org
>>> Hello,
>>>  I am adapting LogWatch to our environment. Fortunately a lot of the work
>>>  has been done to help customize the configuration but I have made some
>>>  changes. In particular, the HOWTO states that the configuration
>>>  structure is the same for all three directories, but in practice this is
>>>  not always true. This patch ensures that logwatch.pl will look in all
>>>  three places for its configuration, and in the proper order.
>>>  Also, I found it useful to separate the "default" and "dist"
>>>  configuration directories. I associate the "default" with what comes
>>>  with this particular version of logwatch and it should refer to the
>>>  package installation directory. The "dist" directory contains
>>>  modifications that affect all my servers. They should reside in a shared
>>>  directory outside of the package so that it is easy to upgrade. I have
>>>  also changed the naming convention to fit my environment.
>>>  Not sure if these are of interest to you but I figured I would share
>>>  them anyway.
>> This one is confusing to me. I would normally think that the 
>> /etc/logwatch/conf would be enough since the RPM spec says not to 
>> upgrade these files? I might be missing the point. I'm going to pass on 
>> this for now, Bjorn can weigh in if he has the time since the dist/ was 
>> his baby.
> As I understood it,
> default.conf/ -> default logwatch configuration
> dist.conf/    -> changes made for some distribution (usually from the
>                  package maintainer)
> Both of the above usually in /usr/share/logwatch or some similar
> directory.
> /etc/logwatch/conf/ -> local changes
> It should be enough to touch the stuff in /etc/logwatch/conf/. Unless of
> course you are a package maintainer. The OP should better move his
> changes from "dist" to "etc".
> HTH,
> Markus

Yes, I share Markus's view.  "dist" refers to Linux (or other OS) 
distributions.  For example, I know debian makes use of the dist 
directory.  To provide a historical perspective, there is no standard 
for naming log filenames, or which service writes to which log.  That 
created conflicts, and required many changes between distributions in 
the form of diff patches.  The "dist" directory structure was set up to 
minimize those changes - the changes are now self-contained in files 
that need not change between releases, and therefore the patch files do 
not need to be modified for new releases, every time the source file is 

Going back to the original problem, one solution might be to create a 
new package for your environment, for your servers.  The modifications 
are distributed in your new (internal to your environment) package.  If 
you are using the default Logwatch distribution, you can place these 
modifications in the "dist" directory itself, as otherwise it would be 
empty.  The key is that the updates would happen through the package 
update process.

Another solution is to centrally-mount (share) the /usr/share directory 
among your servers.  That is precisely how that directory was defined to 
be used in the Linux Filesystem Hierarchy Standard.  I realize that is 
not often done, because of relatively cheap storage, but Logwatch was 
modified to comply with that standard.  That's also why the variable 
data (working files) go into /var, and the local modifications go into 
/etc, as defined in the spec.

More information about the Logwatch-Devel mailing list