[Logwatch] splithosts option

logwatch at buglecreek.com logwatch at buglecreek.com
Thu Jun 15 14:28:28 MST 2006

On Thu, 15 Jun 2006 13:53:06 -0700, "Mike Tremaine"
<mgt at stellarcore.net> said:
> On Thu, 2006-06-15 at 14:21 -0600, logwatch at buglecreek.com wrote:
> > I am experimenting with the --splithosts option on a server that logs
> > three different hosts syslog messages.  I was using logwatch-6.1.2-1 and
> > ran "logwatch --splithosts" which created a single /tmp/logwatch output
> > file that separated out two of the three hosts, all most what a wanted. 
> > I could not tell why it did not separate out the third.  I then decided
> > to
> > upgrade to 7.3.  I ran "logwatch --splithosts" once again and it only
> > reported on the local host not the two that are remote logging.  I then
> > ran "logwatch" w/o the splithosts option and it gave me all the
> > information for the three hosts, but all combined.  You can not tell
> > which hosts the messages are originating from.  Is there something I do
> > not understand about this option.  My goal is to have a single report
> > created with three different sections separated by the host.  It seemed
> > like it would be possible based on the behavior I saw in the 6.1.2
> > version.
> > 
> Are you sure you have 7.3 installed correctly. I only ask because I we
> had a splithosts bug and it was reported fixed in 7.2.1[ish]. And just
> to make sure I just ran logwatch --splithosts --print on my server and
> it generate the reports correctly. 
> [mgt at sirius ~]$ rpm -q logwatch
> logwatch-7.3-1
> [and other then a mailscanner patch this should be stock 7.3, so at
> least I'm eating my own dog food as they say.]
> -Mike
> _______________________________________________
> Logwatch mailing list
> Logwatch at logwatch.org
> http://www2.list.logwatch.org:8080/lists/listinfo/logwatch

"logwatch --version" returns Logwatch 7.3 (released 03/24/06).  Rpm
version is same as yours.  

Interestingly enough, I did "logwatch --splithosts --print" as you did
and it generated the stdout report correctly.  If however I have "Print
= No" and "Save = /tmp/logwatch" in logwatch.conf and then run "logwatch
--splithosts" the /tmp/logwatch report does not get generated correctly
like the stdout report does when --print is used.  I do some extra stuff
with the logwatch file, so it would be nice to figure this out, even
though piping stdout to a file would probably be a workaround.  I guess
playing with the options some more is in order.  

More information about the Logwatch mailing list