[Logwatch] how tell if logwatch working??->won't email me res ults...

Systems Administrator sysadmin@sunet.com.au
Tue, 15 Apr 2003 12:12:57 +1000


----- Original Message -----
From: <seberino@spawar.navy.mil>
To: "Patrick Nelson" <pnelson@neatech.com>
Cc: <logwatch@logwatch.org>
Sent: Tuesday, April 15, 2003 11:06 AM
Subject: Re: [Logwatch] how tell if logwatch working??->won't email me res
ults...


> Patrick
>
> Is there a harmless thing I could do to *intentionally*
> set off a logwatch alarm???
>
> Why?? Well, I've got about 10 Logwatch reports so
> far and none of them say anything.
> I need to know if it *will* say something when
> there is a *real* alarm!


    I have the detail set to medium, and it tells me who has logged in, and
how many times.  So logging in (or using su or sudo) should show something
in your logwatch.  I'm using version 4.3.1, but that shouldn't make a
difference.

    Some other things to check:
1.    Are the messages being logged in the logfiles?
2.    Is it processing the correct logfiles?
3.    Does it have the time set correctly?  If it's been told to do reports
for yesterday, but the logs for yesterday have been rotated into a different
logfile by logrotate (or another cron job), then you won't get any reports.

    Thanks,

Tim Nelson
Systems Administrator
Sunet Internet
Tel:  +61 3 5241 1155
Fax: +61 3 5241 6187
Web: http://www.sunet.com.au/
Email: sysadmin@sunet.com.au