LinuxQuestions.org
Help answer threads with 0 replies.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Software
User Name
Password
Linux - Software This forum is for Software issues.
Having a problem installing a new program? Want to know which application is best for the job? Post your question in this forum.

Notices


Reply
  Search this Thread
Old 03-20-2011, 08:29 AM   #1
pingu
Senior Member
 
Registered: Jul 2004
Location: Skuttunge SWEDEN
Distribution: Debian preferably
Posts: 1,350

Rep: Reputation: 127Reputation: 127
Logwatch too verbose, don't want 404 messages


I recently installed logwatch on a server, problem is that the report is filled with hundreds of lines "Requests with error response code ,404"
I've searched the docs and all over the Internet, strangely enough only found 1 person with similar problem and the solution provided does not help me.
Setting these in etc/logwatch/conf/services/http.conf doesn't change anything:
HTTP_IGNORE_ERROR_HACKS = 1 (tried 0 and 1)
HTTP_RC_DETAIL-404 = 10 (tried 0,5,10,Low,Med,High)
(Adding a wrong entry makes Logwatch spit out an error message, so the file is read.)
Detail setting för logwatch is "Low".
Any ideas how to stop Logwatch from reporting 404:s?
 
Old 03-20-2011, 09:16 AM   #2
Snark1994
Senior Member
 
Registered: Sep 2010
Distribution: Debian
Posts: 1,632
Blog Entries: 3

Rep: Reputation: 346Reputation: 346Reputation: 346Reputation: 346
Firstly, why are you trying to stop it reporting 404s? That probably means you've got broken links on your site, which you should be fixing you've set the RC_DETAIL-404 to 10, which I'm guessing is higher than your detail setting, so you're only getting a one-line error report. I would lower the RC_DETAIL-404 setting and fix the broken links.

However, I'm aware it might *not* be broken links and it could even be something which leaves you utterly blameless. In which case, I think adding the line
Code:
*404*
to /etc/logwatch/conf/ignore.conf should do the trick...
 
Old 03-20-2011, 10:33 AM   #3
pingu
Senior Member
 
Registered: Jul 2004
Location: Skuttunge SWEDEN
Distribution: Debian preferably
Posts: 1,350

Original Poster
Rep: Reputation: 127Reputation: 127
Thanks for your reply!
Adding "*404* to /etc/logwatch/conf/ignore.conf does not work, only output from logwatch then is
Code:
"Quantifier follows nothing in regex; marked by <-- HERE in m/* <-- HERE 404*/ at /usr/sbin/logwatch line 1199, <TESTFILE> line 2."
I tried several variants with 404, "404 Not Found" etc but nope. Either I get all lines or a completely empty report.
Why I'm trying to stop it reporting 404s is because I'm not responsible for the websites on this server, my job is just to keep it up & running. I have notified the developers about these 404:s (they are pretty strange as the reported links actually works!) but as long as they keep coming I need to filter them out to get the report readable. I do not want to stop all messages from httpd though!
Quote:
you've set the RC_DETAIL-404 to 10, which I'm guessing is higher than your detail setting, so you're only getting a one-line error report.
Unfortunately not - it should work that way but it doesn't, I get about 300 lines! Actually, that RC_DETAIL-404 doesn't change anything. It says in /etc/logwatch/conf/services/http.conf:
Code:
"The following is supported for backwards compatibility, but deprecated"
probably removed completely in my version of logwatch ( 7.3.6).
 
Old 03-21-2011, 11:29 AM   #4
Snark1994
Senior Member
 
Registered: Sep 2010
Distribution: Debian
Posts: 1,632
Blog Entries: 3

Rep: Reputation: 346Reputation: 346Reputation: 346Reputation: 346
Hm, sorry, I didn't realise it was a proper regex. My guess is
Code:
.*404.*
will work

I don't know how much you know about regular expressions - I was thinking that '*' would stand for any string (similar to globbing in the bash shell), but it seems to be used in its "proper" sense, which means repeat the previous character any number of times (including none). It was complaining because there was no character before it. And '.' matches any character, not a literal fullstop.
 
1 members found this post helpful.
Old 03-24-2011, 06:12 AM   #5
pingu
Senior Member
 
Registered: Jul 2004
Location: Skuttunge SWEDEN
Distribution: Debian preferably
Posts: 1,350

Original Poster
Rep: Reputation: 127Reputation: 127
In a way, that worked!
(I know a little something about regex:s, not very much though. Whenever I need one it always takes me an hour or so to get it right.)
But it seems that the file "ignore.conf" only filters the report, taking out the lines containing "404" in the report only - it does not ignore lines in logfiles.
This means I now get 298 rows instead of 300...
For clarification, here's a snippet:
W/o ignore.conf:
Code:
Requests with error response codes
404 Not Found
       //dagdok.org/en/un-structure/main-bodies/e ... forum.html: 2 Time(s)
       //index.php?id=1643: 1 Time(s)
       //index.php?id=1644: 1 Time(s)
       /_vti_inf.html: 3 Time(s)
       /admin/file_manager.php/login.php?action=d ... %65%2E%70%68%70: 1 Time(s)
       /aktuellt/aktuellt/aktuellt/aktuellt/page.html: 1 Time(s)
With ignore.conf:
Code:
Requests with error response codes
       //dagdok.org/en/un-structure/main-bodies/e ... forum.html: 2 Time(s)
       //index.php?id=1643: 1 Time(s)
       //index.php?id=1644: 1 Time(s)
       /_vti_inf.html: 3 Time(s)
       /admin/file_manager.php/login.php?action=d ... %65%2E%70%68%70: 1 Time(s)
       /aktuellt/aktuellt/aktuellt/aktuellt/page.html: 1 Time(s)
So I'll keep on searching, still happy for your help so far!
Hmmm maybe I'll set logwatch up to email the developers every hour, might make them more interrested in solving the actual problems..
 
Old 03-24-2011, 11:15 AM   #6
Snark1994
Senior Member
 
Registered: Sep 2010
Distribution: Debian
Posts: 1,632
Blog Entries: 3

Rep: Reputation: 346Reputation: 346Reputation: 346Reputation: 346
Hm.... I don't know. My approach would be to try to lower the verbosity of the error reporting so that all of the information for the 404 error was on one line, but I can't find anything to suggest this is possible... Perhaps browsing through /usr/share/doc/logwatch might have some info

EDIT: You did say setting 'Detail = Med' didn't work, right?

Last edited by Snark1994; 03-24-2011 at 11:25 AM.
 
Old 03-24-2011, 12:13 PM   #7
pingu
Senior Member
 
Registered: Jul 2004
Location: Skuttunge SWEDEN
Distribution: Debian preferably
Posts: 1,350

Original Poster
Rep: Reputation: 127Reputation: 127
I already have Detail=Low for logwatch, tried then various settings for RC_DETAIL-404 but as mentioned earlier it has no effect.

... and I sure have read the docs for logwatch, as well as searched like h..ll for a solution!
All I've found is suggestions to set RC_DETAIL-404 higher than l the logwatch detail-level, but as mentioned it doesn't work.
 
Old 05-11-2011, 12:36 AM   #8
goatfishes
LQ Newbie
 
Registered: May 2011
Posts: 1

Rep: Reputation: 1
As far as I am aware, the services/http.conf setting should be

Code:
$HTTP_RC_DETAIL_REP-404 = <level>
Setting a level higher than the global or service detail level will produce a summary output.

To suppress output entirely then, filter the resulting summary lines in ignore.conf using

Code:
404 Not Found
 
1 members found this post helpful.
Old 05-30-2011, 07:54 AM   #9
pingu
Senior Member
 
Registered: Jul 2004
Location: Skuttunge SWEDEN
Distribution: Debian preferably
Posts: 1,350

Original Poster
Rep: Reputation: 127Reputation: 127
Quote:
Originally Posted by goatfishes View Post
As far as I am aware, the services/http.conf setting should be
Code:
$HTTP_RC_DETAIL_REP-404 = <level>
That did it!!
So it is "HTTP_RC_DETAIL_REP-404" - not "HTTP_RC_DETAIL-404"!
A small error then in the default logwatch.conf, I never could have guessed that!
Thanks a lot!

Last edited by pingu; 05-30-2011 at 11:05 AM.
 
Old 07-21-2014, 10:29 AM   #10
Ken Emerson
LQ Newbie
 
Registered: May 2011
Posts: 3

Rep: Reputation: Disabled
[SOLVED] Logwatch too verbose, don't want 404 messages

Trying to solve this problem and ran across this post. Tried the suggested change in http.conf in the services for logwatch with no success. After looking in the /usr/share/logwatch/default.conf/services directory, found the default http.conf file used by logwatch with a line commented out that was slightly different than the answer given.

Added the following line to the /etc/logwatch/conf/services/http.conf (had to create)

$http_rc_detail_rep_404 = 20

After making this change and running logwatch, the output then looked like this:

--------------------- httpd Begin ------------------------

Requests with error response codes
404 Not Found SUMMARY - 340 URLs, total: 1044 Time(s)

---------------------- httpd End -------------------------

Just wanted to help others out when encountering this issue. Running logwatch version 7.4.0 on Ubuntu 12.04 LTS 64bit.

Regards,

Ken E.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
jack : how to disable verbose debug messages angelo_maci Linux - Software 2 06-18-2010 04:10 AM
Inhibit GTK verbose messages when running GTK/Gnome applications from terminal d1s4st3r Linux - Software 1 11-10-2009 10:33 PM
Tracking log messages with Logwatch cxiii Fedora 11 02-19-2008 09:11 AM
LogWatch error messages XT8088 Red Hat 0 09-10-2003 07:04 PM
Help with Logwatch/Logsentry messages jack101 Linux - Security 2 09-03-2003 07:49 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Software

All times are GMT -5. The time now is 11:51 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration