[Logwatch] No Reports

Patrick Nelson pnelson@neatech.com
Mon, 24 Mar 2003 11:36:24 -0800


Can not figure out why logwatch isn't producing any reports.

There is a link in /etc/daily pointing to /etc/lod.d/logwatch which points
to /etc/log.d/scripts/logwatch.pl

I can run the script like

 cd /etc/log.d
 ./logwatch --print

and I get no output.  So I drill down deeper:

 ./logwatch --service sshd --print

and still nothing.  Adding a --debug med gives me indication that it is
Inside the SSHD filter but that's it as far as output is concerned.

I check the logfile /var/log/secure and there is sshd entries from yesterday
and today. I tried --range today which gives nothing either.  I check
permissions and most all log.d stuff is root:root 644 or 755.  Noticed that
it wasn't working because root doesn't get the daily emails.  It does get
emails from tripwire, but because this doesn't display any data when run
with the print I don't think it is emailing.

So I'm not sure what to try to get this working or even what to look at
next.  Google wasn't helpful either.