[Logwatch] logwatch is DOA - need help/suggestions followup with more info

Dale Morin dale at mustanginternetservices.com
Thu Oct 2 03:56:55 MST 2008


> OK second round of questions.
> 
> 1) Which version of logwatch are you using? If possible check the  
> head of logwatch.pl file to tell me the revision number also.

#!/usr/bin/perl -w
use strict;
##########################################################################
# $Id: logwatch.pl,v 1.192 2007/05/20 00:24:20 kirk Exp $

> 2) You have plenty of diskspace in /tmp right and the ability to  
> write to it.

Right, no issues with disk space or write privs.

> 3) This only happens with the "named" service? The last work in that  
> was 2007/09/02 so nothing much has changed there. Did your  
> modification alter anything related to /usr/share/logwatch/scripts/ 
> services/named ???

This happens regardless of the service or services that are "active".  I 
just chose named as this server is a dns server and I know the logs are 
there.  I also updated logwatch.conf to remove my custom services in 
case one of them was misbehaving.

> When you do a ps don't just grep for logw logwatch uses lots of pipes  
> so other things get forked off you can probably grep for "perl" if  
> need be put you should take a look at all the processes to see if  
> something more obvious is being wedged.

I will check for perl with ps.

> Otherwise this is an oddity, never seen it. Are the logs under heavy  
> load, that is is syslog writing to the log file that is being parsed  
> at the same time very fast? I remember seeing something like a 3-4  
> hour run under a heavy loaded server a long time ago but I think we  
> cleaned some of that up.

This is a dns machine, nothing more.  The total traffic throough eth0 is 
on the order of 20-25mb daily.  Very lightly loaded.

Thanks for your assistance.


-- 
Dale Morin, Mustang Internet Services, Inc.



More information about the Logwatch mailing list