Monitoring tomcat6 access log with logwatch
 

I want to monitor tomcat access.log and catalina.out using logwatch.
There are many tutorials on how to implement new log file groups but I couldn't find any example for setting up a filter in /etc/logwatch/scripts/services/ for monitoring the tomcat logs.
Any help is appreciated.
Thanks.

First of all I wouldn't monitor files like catalina.out itself, as it gets rewritten each Tomcat restart, but instead use Rsyslogd or equivalent. make it read catalina.out as input file and output it to syslog or a custom log plus you'll get syslog time stamps as well. As far as creating a custom Logwatch filter that's quite easy. If you're using a custom log file location like catalina.out then specify a log file in /usr/share/logwatch/logfiles/ and a service in /usr/share/logwatch/services/ (just copy one existing file as template and modify it). While you're testing run 'logwatch --service tomcat --detail Med --output stdout --debug High' to check if your filters work.

Specifying a service in /usr/share/logwatch/services/ is the challenge for me. Even if copying an existing one I'm not sure how to modify them. They are written in PEARL I guess and I'm not familiar with PEARL.
That's why I asked for some sample code.