[Logwatch] logwatch is DOA - need help/suggestions followup with more info

Mike Tremaine mgt at stellarcore.net
Wed Oct 1 18:20:07 MST 2008


On Oct 1, 2008, at 4:18 PM, Dale Morin wrote:
>
> I altered the /bin/sh symlink to point to /bin/bash instead of
> /bin/dash.  Here are the relevant lines from /bin:
>
>
> Then, I reran the command line I had used before.  There is no
> difference in the behavior, but for completeness, here is the output:
>
> 0> logwatch --service named --range yesterday --detail high --print
> --debug 100
>
>

OK second round of questions.

1) Which version of logwatch are you using? If possible check the  
head of logwatch.pl file to tell me the revision number also.

Like: # $Id: logwatch.pl,v 1.211 2008/05/09 01:05:29 mike Exp $

2) You have plenty of diskspace in /tmp right and the ability to  
write to it.

3) This only happens with the "named" service? The last work in that  
was 2007/09/02 so nothing much has changed there. Did your  
modification alter anything related to /usr/share/logwatch/scripts/ 
services/named ???

When you do a ps don't just grep for logw logwatch uses lots of pipes  
so other things get forked off you can probably grep for "perl" if  
need be put you should take a look at all the processes to see if  
something more obvious is being wedged.

Otherwise this is an oddity, never seen it. Are the logs under heavy  
load, that is is syslog writing to the log file that is being parsed  
at the same time very fast? I remember seeing something like a 3-4  
hour run under a heavy loaded server a long time ago but I think we  
cleaned some of that up.


-Mike


More information about the Logwatch mailing list