[Logwatch] SSH section disappearing

Mike Tremaine mgt at stellarcore.net
Tue Dec 2 09:04:28 MST 2008


Jean-Michel Philippon-Nadeau wrote:
> Mike,
> 
> Thanks for the reply,
> 
> Mike Tremaine wrote:
>> I think the Detail variable might have some influence on the output of 
>> the sshd service report. That's my crystal ball guess... Otherwise like 
>> Hugo said more info would be good.
> 
> My logwatch.conf files are identical on every machine running here:
> 
> MailTo = "securite at ccs.usherbrooke.ca"
> MailFrom = "logwatch at ccs.usherbrooke.ca"
> Detail = 3
> 
> It's all the same OS, same logwatch. The only thing that might differ is
> the IP address and the hostname...
> 
> This is why I thought there could be an option somewhere... But all I
> could find was the "detail" option too.
> 
> 

Strange...

First you should us host 10 and 2 's setups but the logwatch snip looks 
like it is from host 9... Is that right? Also do the same cat grep on 
host 2's secure log just to compare the syslog format.

There at least a slightly newer logwatch rpm out there I think. Check 
the logwatch site you should be on

[mgt at dwarfstar services]$ logwatch -v
Logwatch 7.3.6 (released 05/19/07)

Check the default.conf logwatch.conf that is

cat /usr/share/logwatch/default.conf/logwatch.conf

Just make sure no one messed with the defaults.

That's all I got off hand.

-Mike


More information about the Logwatch mailing list