logwatch

aolong · 09-10-2007, 01:41 PM

I have logwatch configured to email the report; I keep getting duplicate reports and can't figure out why. There is only one "address" in /etc/log.d/logwatch.conf (root), which is aliased in to an email on another local server. A small issue, but a nuisance I'd like to figure out. I did check both messages on a given day and they have the exact same header (including message id) except for the last field, X-NAS-Validation.

marozsas · 09-10-2007, 02:41 PM

This is because logwatch process the current log file. Until it is rotated and a new (empty) file take place, it generates the same old output.
What I did was to put out from cron.daily both cron jobs: logwatch and logrotate and put them in a well scheduled cron job, running logwatch just before logrotate. In this way, after logrotate ran, a new empty log file take its place, with new output to be processed by logwatch in the next cycle.

aolong · 09-11-2007, 06:10 AM

Quote:

Originally Posted by marozsas

This is because logwatch process the current log file. Until it is rotated and a new (empty) file take place, it generates the same old output...

I found the problem... /etc/log.d/logwatch.conf specified mailto:root AND /etc/cron.daily/00-logwatch specified mailto:root. Changing /etc/cron.daily/00-logwatch to "mailto:""" fixed it; I received one log this morning.

aolong · 09-11-2007, 12:41 PM

Well, it didn't do the trick after all, so I've followed your advice and removed 00-logwatch from cron.daily and created a root cron job which runs earlier...