I want to disable logwatch on our RHEL servers to stop the logwatch mail
 

Hi all,

I need to once and for all tune our root mailbox input on our RHEL servers to keep the root mails down to a minimum.

I've set the /etc/crontab MAILTO var to null so that cron stops mailing root. Now I want to stop logwatch from loading up the root mailbox.

We have a number of monitoring apps in our environment so logwatch isn't really needed.

I've been poking at anacron and the /etc/cron.daily where the logwatch is a symlink to a logwatch.pl perl script.

If I remove the symlink to the logwatch.pl - will that effectively do want I want to do without screwing up anything else ? ( I don't want to turn sendmail off either. )

If anyone has a better idea for getting logwatch mail out of the mix , let me know.

Thx,
Stv

Why don't you uninstall logwatch ?

Thanks for the suggestion
 

Thanks for that. Any other ideas short of uninstalling it ?

I have not tried this, but maybe leave mailto blank in /etc/crontab

Maybe even make logwatch.pl non-executable

Or change mailto to "nobody" and make nobody mail to /dev/null (In the /etc/alias file)?

-C

You can also set this variable to null like this:
$ crontab -l
..
MAILTO=""
..

All set on the logwatch issue - Thanks
 

Hey all

thanks for the responses.
the mailto var in etc/crontab was already done to keep cron from mailing root. I think at this point the first reply I got is probably the way we'll go and just un-install logwatch. Thx

The Logwatch cronjob is by default run out of /etc/cron.daily and it is a symbolic link to the actual Perl script. Ergo just removing the symlink should do.

Removing the symlink to logwatch.pl is probably the most elegant way to do this without causing other side effects. Keep in mind that if/when you upgrade the package it will likely recreate the symlink.

An alternative to all this is: forward root's mail to an email account you check regularly, and actually read the logwatch reports. Monitoring your system logs is a good way to get a feel for normal activity, and a good way to get advance warning when something odd is going on.

Or, you could just configure logwatch to send the reports whereever you want them, such as an entry in /etc/aliases to that pipes to /dev/null.

Override the default "MailTo = root" that appears in /usr/share/logwatch/default.conf/logwatch.conf by adding a "MailTo =" line in your local configuration file which is /etc/logwatch/conf/logwatch.conf.

Just wondering, why would you run logwatch on your system, if you don't want emails from the results?
Uninstall, it just uses resources.