LinuxQuestions.org
Review your favorite Linux distribution.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Software
User Name
Password
Linux - Software This forum is for Software issues.
Having a problem installing a new program? Want to know which application is best for the job? Post your question in this forum.

Notices


Reply
  Search this Thread
Old 09-08-2009, 10:28 PM   #1
abefroman
Senior Member
 
Registered: Feb 2004
Location: lost+found
Distribution: CentOS
Posts: 1,430

Rep: Reputation: 55
How can I get logwatch to ignore unmatched entries?


How can I get logwatch to ignore unmatched entries?

Example:
Code:
--------------------- Connections (secure-log) Begin ------------------------ 
 **Unmatched Entries**
 Cp-Wrap[10673]: Pushing "733 CHECKDOMAINIPFORSSL ko*****.com " to '/usr/local/cpanel/bin/ssladmin' for UID: 733
 Cp-Wrap[10673]: CP-Wrapper terminated without error
 Cp-Wrap[10748]: Pushing "733 LISTDBSWITHSPACE " to '/usr/local/cpanel/bin/mysqladmin' for UID: 733
 Cp-Wrap[10748]: CP-Wrapper terminated without error
I have about 5,000 of those lines, that start with: Cp-Wrap.

I tried negating that service in the config file and got the error:
Code:
# /usr/share/logwatch/scripts/logwatch.pl
Nonexistent service to disable: cp-wrap
Any ideas?

TIA
 
Old 09-09-2009, 05:32 AM   #2
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3590Reputation: 3590Reputation: 3590Reputation: 3590Reputation: 3590Reputation: 3590Reputation: 3590Reputation: 3590Reputation: 3590Reputation: 3590Reputation: 3590
Only by looking at threads like this you will realise that by making Logwatch actually display logged errors you can take action. In short: keeping errors from being displayed defeats the purpose of logging and using Logwatch.

What you should do is create a service configuration. Using the "up2date" service (since it's a small config) as example, you see it comprises of:
- a service declaration in /usr/share/logwatch/default.conf/logfiles/up2date.conf,
- a logfile declaration in /usr/share/logwatch/default.conf/services/up2date.conf,
- log preprocessing scripts log in /usr/share/logwatch/scripts/logfiles/ and
- the actual service processing script /usr/share/logwatch/scripts/services/up2date.

In the scripts/services/up2date script, at around like 27 it starts the "ignore" section in which you can add all lines that are of the informational level or purpose:
Code:
    22  while (defined($ThisLine = <STDIN>)) {
    23     if ( $Debug >= 5 ) {
    24        print STDERR "DEBUG($DebugCounter): $ThisLine";
    25        $DebugCounter++;
    26     }
    27     if ( ( $ThisLine =~ /^updating login info$/ ) or
and further down, at around 60, actions that should be tallied, and at around 78 lines that fit no classification that you should be informed about anyway. The point is that by creating a "cpanel service" configuration you can give back to Logwatch by extending and improving it. If you want help creating the service config attach a file with a sufficient amount of usable log lines.

Your other option is adding regexes to /etc/logwatch/conf/ignore.conf, one item per line (gets matched through "$logline =~ m/$ignore/;"), like:
Code:
Cp-Wrap
which would greedy-match all lines including that text, or more specifically:
Code:
Pushing "733
terminated without error
* I'm not sure the "733 needs to be escaped as \"733. Run it to find out and post back if it works or not.

Last edited by unSpawn; 09-09-2009 at 05:33 AM.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
LogWatch ignore.conf not working fukawi2 Linux - Software 5 07-13-2011 05:36 PM
I want to disable logwatch on our RHEL servers to stop the logwatch mail svik Linux - Enterprise 10 08-27-2009 03:51 PM
Logwatch unmatched entries courier mail collen Linux - Server 3 11-22-2006 11:07 AM
LogWatch Cron :: Unmatched Entries elvisious Linux - Software 2 06-23-2004 08:10 AM
Strange problem (Unmatched Entries) 2HostMe Linux - Newbie 2 01-10-2004 09:32 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Software

All times are GMT -5. The time now is 06:29 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration