[Logwatch] Logwatch will not report

Hugo van der Kooij hvdkooij at vanderkooij.org
Wed Jan 3 11:39:35 MST 2007


On Wed, 3 Jan 2007, bizzy wrote:

> Hugo van der Kooij wrote:
>>
>> Could you see if anything more recent works better? the given version is
>> rather old considering we are now at version 7.3.2
>>
> I don't think Logwatch itself is the problem, merely the messenger. I've
> just been digging in /var/log. I wonder if the prob is with logrotate or
> even with crond itself (but crond is running). Here is a typical section of
> the directory of the 'bad' server for, say, mail:
>
> -rw-------   1 root     root        0 Dec 31 04:02 maillog
> -rw-------   1 root     root        0 Dec 24 04:02 maillog.1
> -rw-------   1 root     root        0 Dec 17 04:02 maillog.2
> -rw-------   1 root     root        0 Dec 10 04:02 maillog.3
> -rw-------   1 root     root   252192 Jan  3 14:05 maillog.4

Well. This is in fact the good one. At least it has a sane log rotation 
schedule. The odd thing is however that maillog and maillog.4 seem to have 
been switched.

It should rather look like:

-rw-------  1 root root  6387433 Jan  3 19:34 /var/log/maillog
-rw-------  1 root root 13799626 Dec 31 04:02 /var/log/maillog.1
-rw-------  1 root root 10679451 Dec 24 04:02 /var/log/maillog.2
-rw-------  1 root root 11434636 Dec 17 04:02 /var/log/maillog.3
-rw-------  1 root root 10400197 Dec 10 04:02 /var/log/maillog.4
-rw-------  1 root root 10848358 Dec  3 04:02 /var/log/maillog.5
-rw-------  1 root root 12668022 Nov 26 04:02 /var/log/maillog.6
-rw-------  1 root root 12405775 Nov 19 04:02 /var/log/maillog.7
-rw-------  1 root root 12610964 Nov 12 04:02 /var/log/maillog.8
-rw-------  1 root root 11533240 Nov  5 04:02 /var/log/maillog.9

> Whereas on the 'good' server we do not get files of the form <servicelog>.x
> - only this corresponding line:
>
> -rw-------   1 root     root  1805768 Jan  3 14:12 maillog

Just fill it a little more and this one will start killing your system. It 
is like putting a year supply of eggs in one basket. Logrotation is a good 
thing.

> On the presumption that logwatch parses maillog then I get a result from
> this latter file on the good server but not from the empty maillog on the
> bad server. This is an unknown area to me - but it would be great to get up
> to speed. Can you help?

It seems you need to investigate logrotate. That is how these weekly logs 
get there. (Or at least that is how it is usually done.) But you need to 
investigate the system to see what happens to the logs as logwatch can not 
perform miracles and generate reports out of thin air.

Hugo.

-- 
 	hvdkooij at vanderkooij.org	http://hvdkooij.xs4all.nl/
 	    This message is using 100% recycled electrons.


More information about the Logwatch mailing list