logwatch - duplicate email
 

I have logwatch configured to email the report; I keep getting duplicate reports and can't figure out why. There is only one "address" in /etc/log.d/logwatch.conf (root), which is aliased in to an email on another local server. A small issue, but a nuisance I'd like to figure out. I did check both messages on a given day and they have the exact same header (including message id) except for the last field, X-NAS-Validation.

This is because logwatch process the current log file. Until it is rotated and a new (empty) file take place, it generates the same old output.
What I did was to put out from cron.daily both cron jobs: logwatch and logrotate and put them in a well scheduled cron job, running logwatch just before logrotate. In this way, after logrotate ran, a new empty log file take its place, with new output to be processed by logwatch in the next cycle.

I found the problem... /etc/log.d/logwatch.conf specified mailto:root AND /etc/cron.daily/00-logwatch specified mailto:root. Changing /etc/cron.daily/00-logwatch to "mailto:""" fixed it; I received one log this morning.

Well, it didn't do the trick after all, so I've followed your advice and removed 00-logwatch from cron.daily and created a root cron job which runs earlier...