Hi,

I am getting a daily report via email from Logwatch from a couple of my RH 9 servers with the header:

################### LogWatch 4.3.1 (01/13/03) ####################
Processing Initiated: Mon Sep 11 04:02:01 2006
Date Range Processed: yesterday
Detail Level of Output: 0
Logfiles for Host: backserver
################################################################

But I do not have any crontab entry for logwatch. I also checked with ps -ax and I was not able to find any running tasks named log*. How is logwatch activated automatically on a daily basis without a cron job?


Also, I noticed that the mailed report does not have the date/time stamp. For instance /var/log/messages show:

"Sep 11 04:02:03 backserver syslogd 1.4.1: restart
Sep 10 04:03:06 backserver smartd[1994]: Device: /dev/hda, SMART Usage Attribute: 195 Hardware_ECC_Recovered changed from 65 to 64"

But the email from logwatch shows:

"/dev/hda :
1 Time(s): SMART Usage Attribute: 195 Hardware_ECC_Recovered changed from 65 to 64"

How can I get the time stamp on that mailed report?

I was not able to find this time option on the file "/etc/log.d/conf/logwatch.conf" or in "man logwatch".

Thanks in advance,

David

Maybe /etc/cron.d and maybe it's a link not a file. Just try and "slocate" it.
Anyway, I'll move this thread. Ain't a security question.

Thanks for the reply. I did not have anything in /etc/cron but I did in /etc/cron.daily:
lrwxrwxrwx 1 root root 28 Apr 10 2005 00-logwatch -> ../log.d/scripts/logwatch.pl

I only need now to figure out how to keep the timestamp from the original /var/log/messages logs. Any suggestions.

No timestamps. If you need on-alert notification you should run something that parses syslog in realtime like Swatch.

Thanks unSpawn! I will look into Swatch for critical issues.

I wasn't trying to have logwatch to add new timestamps just simply not to remove the ones already present on the original log files. I suppose that logwatch is removing the begining of each line of the /var/log files with the date/time string. I had hopped that perhaps this behavior was a configurable option but does not seem to be the case.

Thanks again for your feedback.

just simply not to remove the ones already present on the original log files.
No, can't do that. It's how Logwatch is able to select loglines to check.
It would probably also make it a lot harder to tally messages the way it does.