[Logwatch] HostLimit troubles

Mike Tremaine mgt at stellarcore.net
Tue Jul 28 16:08:33 MST 2009


>
>>
>> from the --version command
>>
>> Logwatch 7.3.6+cvs20080702-debian (released 07/02/08)
>
>>> > HostLimit = Yes
>>> >
>>> > line in /etc/logwatch/logwatch.conf and this is the basics of the
>>> > logwatch
>>> > command that I'm using
>>> >
>>> > logwatch --range today --hostformat split --service sshd --hostlimit
>>> > remote1,remote2 --mailto myemail
>>> >
>
>
> Oh good you have a pretty recent version which should have the right code base
> of this stuff. Now to figure out what's going on.
>
>
> I don't think you need to mess with HostLimit = Yes  since --hostlimit
> remote1,remote2 should handle that, make sure the remote1 and remote2 names
> match the hostnames in the logs obviously and try running with debug set
> something like
>
> logwatch --range today --output stdout --hostformat split --service sshd
> --hostlimit remote1,remote2 --debug 100
>
> That should spit out lots of stuff plus save the tmp files to see what is
> matching in the log file. Remember to delete the tmp dir after you are done
> looking at it or you'll get a nag reminder about on next run.
>
> -Mike
>



You know I think I see a bug [which is why I was begging someone to test this
back in 2007 :P ]

Try changing line 820 of logwatch.pl  from this

$ENV{'LOGWATCH_ONLY_HOSTNAME'} = $Config{'nohostlimit'};

to

$ENV{'LOGWATCH_ONLY_HOSTNAME'} = $Config{'hostlimit'};


-- 
Mike Tremaine
mgt at stellarcore.net
http://www.stellarcore.net


More information about the Logwatch mailing list