I want to disable logwatch on our RHEL servers to stop the logwatch mail

svik · 08-25-2009, 01:47 PM

Hi all,

I need to once and for all tune our root mailbox input on our RHEL servers to keep the root mails down to a minimum.

I've set the /etc/crontab MAILTO var to null so that cron stops mailing root. Now I want to stop logwatch from loading up the root mailbox.

We have a number of monitoring apps in our environment so logwatch isn't really needed.

I've been poking at anacron and the /etc/cron.daily where the logwatch is a symlink to a logwatch.pl perl script.

If I remove the symlink to the logwatch.pl - will that effectively do want I want to do without screwing up anything else ? ( I don't want to turn sendmail off either. )

If anyone has a better idea for getting logwatch mail out of the mix , let me know.

Thx,
Stv

repo · 08-25-2009, 01:50 PM

Why don't you uninstall logwatch ?

svik · 08-25-2009, 02:09 PM

Thanks for that. Any other ideas short of uninstalling it ?

TBC Cosmo · 08-25-2009, 02:18 PM

I have not tried this, but maybe leave mailto blank in /etc/crontab

Code:

SHELL=/bin/bash
PATH=/sbin:/bin:/usr/sbin:/usr/bin
MAILTO=root
HOME=/

# run-parts
01 * * * * root run-parts /etc/cron.hourly
02 4 * * * root run-parts /etc/cron.daily
22 4 * * 0 root run-parts /etc/cron.weekly
42 4 1 * * root run-parts /etc/cron.monthly

Maybe even make logwatch.pl non-executable

custangro · 08-25-2009, 02:26 PM

Quote:

Originally Posted by TBC Cosmo

I have not tried this, but maybe leave mailto blank in /etc/crontab

Code:

SHELL=/bin/bash
PATH=/sbin:/bin:/usr/sbin:/usr/bin
MAILTO=root
HOME=/

# run-parts
01 * * * * root run-parts /etc/cron.hourly
02 4 * * * root run-parts /etc/cron.daily
22 4 * * 0 root run-parts /etc/cron.weekly
42 4 1 * * root run-parts /etc/cron.monthly

Maybe even make logwatch.pl non-executable

Or change mailto to "nobody" and make nobody mail to /dev/null (In the /etc/alias file)?

-C

edenCC · 08-26-2009, 12:15 AM

Quote:

Originally Posted by custangro

Or change mailto to "nobody" and make nobody mail to /dev/null (In the /etc/alias file)?

-C

You can also set this variable to null like this:
$ crontab -l
..
MAILTO=""
..

svik · 08-26-2009, 08:03 AM

Hey all

thanks for the responses.
the mailto var in etc/crontab was already done to keep cron from mailing root. I think at this point the first reply I got is probably the way we'll go and just un-install logwatch. Thx

unSpawn · 08-26-2009, 08:18 AM

The Logwatch cronjob is by default run out of /etc/cron.daily and it is a symbolic link to the actual Perl script. Ergo just removing the symlink should do.

anomie · 08-26-2009, 12:53 PM

Removing the symlink to logwatch.pl is probably the most elegant way to do this without causing other side effects. Keep in mind that if/when you upgrade the package it will likely recreate the symlink.

An alternative to all this is: forward root's mail to an email account you check regularly, and actually read the logwatch reports. Monitoring your system logs is a good way to get a feel for normal activity, and a good way to get advance warning when something odd is going on.

jonesr · 08-27-2009, 12:34 PM

Or, you could just configure logwatch to send the reports whereever you want them, such as an entry in /etc/aliases to that pipes to /dev/null.

Override the default "MailTo = root" that appears in /usr/share/logwatch/default.conf/logwatch.conf by adding a "MailTo =" line in your local configuration file which is /etc/logwatch/conf/logwatch.conf.

repo · 08-27-2009, 02:51 PM

Just wondering, why would you run logwatch on your system, if you don't want emails from the results?
Uninstall, it just uses resources.