logwatch is not reporting on SSH

abefroman · 09-15-2009, 02:45 PM

logwatch ( 7.3.6 ) is not reporting on SSH (nor pam_unix)

I have failed logins in /var/log/secure and logwatch is not reporting on it.

sshd and sshd2 existing /usr/share/logwatch/scripts/services/

Any ideas?

TIA

chrism01 · 09-15-2009, 07:30 PM

You'll have to check the logwatch settings/cfg file. From this page http://linux.die.net/man/8/logwatch I'd guess the --logfile & --service options will be key.

abefroman · 09-16-2009, 07:43 AM

It started reporting those on its own now, how weird!