Home / Server side scripting / Linux / Install Logwatch and Log analyzer – Linux

Install Logwatch and Log analyzer – Linux

Hi all,

The log files help us to get information about the activities taking place on a server. The Logwatch is a management tool for analyzing and reporting on a server’s log files. It can be used to send information to the system administrator about the log activity as mentioned earlier.

What are log files? Logs are application-generated files useful for tracking down and understanding what has happened in the past.

Step 1: Install Logwatch
As a matter of best practice we’ll update our packages:
yum -y update
Then let’s install Logwatch and any required packages:
yum -y install logwatch
Step 2: Configuration File Locations
Local Configuration Options can be found in:
/etc/logwatch/conf/logwatch.conf
Default Configuration Options can be found in:
/usr/share/logwatch/default.conf/logwatch.conf
It is best practice to leave the Default Configuration as is, and edit the Local Configuration option, which is under /etc as listed above.
Step 3: Configuring Logwatch

  1. The e-mail address to which daily digest (reports) should be sent:
    MailTo = root
    Replace root with your email address required.
    Example: MailTo = admin@nixlinux.com
  2. The e-mail address from which reports originate:
    MailFrom = Logwatch
    You might wish to replace Logwatch with your own again.
    Example: MailFrom = admin@nixlinux.com
  3. Setting the range for the reports:
    Range = yesterday
    You have options of receiving reports for All (all available since the beginning), Today (just today) or Yesterday (just yesterday).
    Example: Range = Today
  4. Setting the reports’ detail:
    Detail = Low
    You can modify the reports’ detail here. Options are: Low, Medium and High.
    Example: Detail = Medium
  5. Setting services (applications) to be analysed:
    By default, Logwatch covers a really wide range of services. If you would like to see a full list, you can query the contents of the file scripts/services located at /usr/share/logwatch/.
    Example: ls -l /usr/share/logwatch/scripts/services
    Service = All
    You can choose to receive reports for all services or some specific ones.
    For all services, keep the line as: Service = All
    If you wish to receive reports for specific ones, modify it similar to the following example, listing each service on a new line (e.g. Service = [name]).
    Example:
    Service = sendmail Service = http Service = identd Service = sshd2 Service = sudo ..
  6. Disabling daily reports:
    #DailyReport = No
    If you do not wish to have daily repots generated, you should uncomment this line.
    Example: DailyReport = No instead of # DailyReport = No
    That’s all, now you will be able to receive daily reports based on log files from your server automatically.
Jishnu KS
Latest posts by Jishnu KS (see all)

Leave a Reply

Your email address will not be published. Required fields are marked *

Social Media Auto Publish Powered By : XYZScripts.com