[Logwatch] running logwatch *hourly* possible? overkill? desirable?

Systems Administrator sysadmin@sunet.com.au
Thu, 17 Apr 2003 18:00:53 +1000 (EST)


On Wed, 16 Apr 2003 seberino@spawar.navy.mil wrote:

> Logwatch seems built to be run daily.
> 
> Could it be run hourly? 

	Yes.  

> -- and only email you if there is a problem?

	Well, you'd have to work at twaeking the filters.  I know mine 
generate about 100 lines of unknowns a day.  But I could cut this back to 
about 15 by adding another 5 filters, and to about 5 by adding maybe 15 
filters.  

	Have you considered "mon"?  http://www.kernel.org/software/mon/

	Mon and logwatch serve different purposes, I realise, but I wonder 
if mon wouldn't do what you want.  Not knowing what problem you're trying 
to solve, I can't tell, though :).  

> There would have to
> be an addition to script that /only/ checked
> log entries for last hour to avoid redundancy
> right??

	That's right.  

> If this overkill? 

	Maybe -- why do you want to do it?  :).  

> desirable? 

	Yes.  

> possible?

	Yes.  

	Be aware that I'm working on an architecturally different version 
of logwatch which will hopefully allow that kind of filtering.  If you're 
interested in helping, let me know, and I'll see what we can do.  

	:)

-- 
Tim Nelson
Systems Administrator
Sunet Internet
Tel:  +61 3 5241 1155
Fax: +61 3 5241 6187
Web: http://www.sunet.com.au/
Email: sysadmin@sunet.com.au