[Logwatch] Problems with configuration

Stefan Jakobs stefan at localside.net
Fri Nov 20 15:23:38 MST 2009


Benon Fuertes wrote:
> # cat /etc/logwatch/conf/logfiles/http.conf
> LogFile = /var/log/apache2/someFile_log

You have checked that /var/log/apache2/someFile_log exists and it contains 
valid data in the specified time range?
 
> # logwatch --output stdout --debug 6 --service http
> /usr/sbin/logwatch: unknown output-format: stdout

Ah, sorry, it should be --print instead of --output stdout. My failure.
> 
> Config After Everything:
> mailer -> /usr/sbin/sendmail -t

It uses the right mailer, good.

> tmpdir -> /var/cache/logwatch
> pathtocat -> cat
> range -> yesterday
> hostname -> someserver.com
> logdir -> /var/log
> encode -> 0
> print -> 0

It will send it as mail.

> save ->
> archives -> 1
> pathtozcat -> zcat
> html_footer -> /usr/share/logwatch/default.conf/html/footer.html
> debug -> 6
> splithosts -> 0
> mailto -> benon.fuertes at diaple.com
> mailfrom -> logwatch
> pathtobzcat -> bzcat
> output -> stdout
> html_header -> /usr/share/logwatch/default.conf/html/header.html
> detail -> 0
> html_wrap -> 80
> multiemail -> 0
> numeric -> 0
> Service List:
> [0] = http
> 
> LogFile List:
> 
<snip>
> ReadConfigFile: Opening /usr/share/logwatch/default.conf/services/
> http.conf
> ReadConfigFile: Opening /etc/logwatch/conf/services/http.conf
> ReadConfigFile: Opening /etc/logwatch/conf/override.conf

It reads your http config file, good.

<snip>
> ReadConfigFile: Opening /usr/share/logwatch/default.conf/logfiles/
> http.conf
> ReadConfigFile: Opening /etc/logwatch/conf/logfiles/http.conf
> ReadConfigFile: Opening /etc/logwatch/conf/override.conf

It reads both logfile configuration files, good.

<snip>
> export LOGWATCH_DATE_RANGE='yesterday'
> export LOGWATCH_OUTPUT_TYPE='stdout'
> export LOGWATCH_TEMP_DIR='/var/cache/logwatch/logwatch.CHYnzrAg/'
> export LOGWATCH_DEBUG='6'
> 
> Preprocessing LogFile: http
> /var/log/apache2/someFile_log  | /usr/bin/perl /usr/share/logwatch/
> scripts/shared/expandrepeats ''| /usr/bin/perl /usr/share/logwatch/
> scripts/shared/applyhttpdate ''>/var/cache/logwatch/logwatch.CHYnzrAg/
> http
> 
> TimeFilter: Period is day
> 
> TimeFilter: SearchDate is (19/Nov/2009:..:..:..)
> 
> TimeFilter: Debug SearchDate is (19/Nov/2009 )
> DEBUG: Inside ApplyHTTPDate...
> DEBUG: Looking For: (19/Nov/2009:..:..:..)
> export http_ignore_error_hacks='0'
> export http_user_display='0'

It seams that your http logfile is empty or doesn't contain data in the 
specified time range. try --range all
 
<snip>

> >> Regarding the other question, it doesn't produce any error except
> >> when I change the service in "logwatch.conf",
> >> it tells me this: Wrong configuration entry for "Service", if "All"
> >> selected, only "-" items are allowed
> >
> > If you have a line 'Service = All' in your logwatch.conf then your
> > are only allowed to remove services with 'Service = "-aservice"'. If you
> > don't have 'Service = All' then you have to define each service you like
> > to use with 'Service = aservice'.
> 
> Yes, I know that. The problem is that when I comment the line "Service
> = All", to disable it, and then add another service like: "Service =
> http", I get the same error message.
> That's what I don't understand.

I couldn't reproduce that error. So most likely you still have a Service = All 
somewhere.

I can't see what's wrong. Please check if:
- your http logfile contains valid log entries in the specified time range
- it works with a different service
- qmail is set up correctly and that you can send emails with sendmail to your 
email address.

And turn on debugging to see what's wrong.
 
> Thank you.

regards
Stefan


More information about the Logwatch mailing list