[Logwatch] Problems with configuration

Benon Fuertes benon.fuertes at diaple.com
Mon Nov 23 03:01:49 MST 2009

El 20/11/2009, a las 23:23, Stefan Jakobs escribió:

> Benon Fuertes wrote:
>> # cat /etc/logwatch/conf/logfiles/http.conf
>> LogFile = /var/log/apache2/someFile_log
> You have checked that /var/log/apache2/someFile_log exists and it contains 
> valid data in the specified time range?

It exists, and for valid data, I assume you are referring to lines with a date in the range of logwatch. It's allright.

>> TimeFilter: Period is day
>> TimeFilter: SearchDate is (19/Nov/2009:..:..:..)
>> TimeFilter: Debug SearchDate is (19/Nov/2009 )
>> DEBUG: Inside ApplyHTTPDate...
>> DEBUG: Looking For: (19/Nov/2009:..:..:..)
>> export http_ignore_error_hacks='0'
>> export http_user_display='0'
> It seams that your http logfile is empty or doesn't contain data in the 
> specified time range. try --range all

I've changed the logfile so now it has this:

LogFile = /var/log/apache2/someFile_log

# Keep only the lines in the proper date range...

> <snip>
>>>> Regarding the other question, it doesn't produce any error except
>>>> when I change the service in "logwatch.conf",
>>>> it tells me this: Wrong configuration entry for "Service", if "All"
>>>> selected, only "-" items are allowed
>>> If you have a line 'Service = All' in your logwatch.conf then your
>>> are only allowed to remove services with 'Service = "-aservice"'. If you
>>> don't have 'Service = All' then you have to define each service you like
>>> to use with 'Service = aservice'.
>> Yes, I know that. The problem is that when I comment the line "Service
>> = All", to disable it, and then add another service like: "Service =
>> http", I get the same error message.
>> That's what I don't understand.
> I couldn't reproduce that error. So most likely you still have a Service = All 
> somewhere.

I've changed now all logwatch.conf files that I have found.
> I can't see what's wrong. Please check if:
> - your http logfile contains valid log entries in the specified time range

I think so.

> - it works with a different service

I think it does, I've tried with qmail and it seems to do a lot of working, so when I press Ctrl+C it stops and gives me this message:

system cat /var/log/syslog /var/log/mail.log  | /usr/bin/perl /usr/share/logwatch/scripts/shared/expandrepeats ''| /usr/bin/perl /usr/share/logwatch/scripts/shared/onlyhost ''| /usr/bin/perl /usr/share/logwatch/scripts/shared/applystddate ''>/var/cache/logwatch/logwatch.gebQAxPz/maillog failed: 2 at /usr/sbin/logwatch line 965.

> - qmail is set up correctly and that you can send emails with sendmail to your 
> email address.
> And turn on debugging to see what's wrong.

It can't send emails through sendmail, however the whole server is used as a mail server through qmail. I think it has some problems with exim, beause it was trying to install it whenever I tried to install something else. So I uninstalled exim and logwatch and installed logwatch again from the sources.
Now I can't use sendmail because the archive is the gone, so I'm trying to use the sendmail that qmail uses, but doesn't work yet though.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www2.list.logwatch.org:81/pipermail/logwatch/attachments/20091123/4d1ef60b/attachment.html>

More information about the Logwatch mailing list