Red Hat Enterprise Linux 5 Administration Unleashed

Viewing Log Files with Logwatch 419For a list of logs that are rotated, refer to /etc/logrotate.conf and the /etc/logrotate.d/ directory.Viewing Log Files with LogwatchTo keep watch on all the log files on each system for which you are responsible, you canwrite customized scripts as cron tasks that execute on a regular basis as discussed inChapter 11, or you can use the Logwatch program to analyze log files and generatereports about them. The Logwatch program is provided by the logwatch RPM package.Install if it is not already installed.This section describes how to customize how log files are analyzed and reported, how tocustomize the scripts used, and how to add additional log files for Logwatch to monitor.Understanding the Logwatch ConfigurationThe Logwatch program includes a script to execute the program once a day and emailreports to the administrator. Installing the logwatch package is all it takes to have theprogram up and running. This subsection outlines the files used by Logwatch.Most of the Logwatch files are installed into the /usr/share/logwatch/ directory with thefollowing subdirectories:. default.conf/: Default configuration files.. dist.conf/: Distribution-specific configuration files. (Red Hat Enterprise Linux doesnot include any.). lib/: Perl library files used by the scripts.. scripts/: Executable scripts used by Logwatch. Most are written in Perl.The default.conf/ directory contains the following files and directories:. logfiles/: Directory that contains configuration files for log file groups. Each logfile group configuration file lists one or more log files that use the same format.Some log file group configuration files may be used by more than one service.. services/: Directory that contains configuration files for each service whose logfiles are monitored by Logwatch such as one for the Apache HTTP server and onefor the Samba file-sharing service.. logwatch.conf: Configuration file that contains the default settings for Logwatch.20Customizing Logwatch ConfigurationLogwatch is configured for the default log file locations in Red Hat Enterprise Linux, sono customization is required. The main reasons to customize it are if you have modifiedany service to use a non-default log file, if you want to change the type of data Logwatchlooks for in the log files, and if you need to add a new set of log files to watch.