Red Hat Enterprise Linux 5 Administration Unleashed

Viewing Log Files with Logwatch 421In addition to the logfiles/ directory, services/ directory, and logwatch.conf file foundin /usr/share/logwatch/default.conf/, the /etc/logwatch/conf/ directory contains twoadditional configuration files: ignore.conf and override.conf. In ignore.conf, if anyLogwatch output from any service matches the regular expressions in this file, they areignored and not included in the report generated.To modify the value of a variable: Instead of declaring it again in the /etc/logwatch/conf/logwatch.conf directory or re-creating in the logfiles/ or services/ directory, allchanged values can be declared in the one file, the /etc/logwatch/conf/override.conffile, using one of the following prefixes for each line (the colon must be included in theprefix followed by a space and then the entire line as it appears in the default configurationfile):. logwatch: This variable overwrites the one found in the default logwatch.conf file.. services/: This variable overwrites the one found in the defaultservices/ (replace with the specific name of the file) file.. logfiles/: This variable overwrites the one found in the defaultlogfiles/ (replace with the specific name of the file) file.Customizing the Logwatch ScriptsThe /usr/share/logwatch/scripts/ directory contains the following directories:. services/: Directory that contains the executable scripts for each service monitoredby Logwatch.. shared/: Directory that contains the executable scripts that might be used by morethan one service.. logfiles/: Directory that contains subdirectories named for log file groups. Theexecutables in the subdirectories are executed when running a service that uses thelog file group.The same method for overwriting variable values is used for the scripts. To modify adefault script, copy it from the /usr/share/logwatch/scripts/ directory into the/etc/logwatch/scripts/ directory while preserving any subdirectories and then modifythe script. If a script with the exact same filename and relative path is found in/etc/logwatch/scripts/, it is used instead of the default script.Creating Service FiltersAs mentioned earlier, the /usr/share/logwatch/default.conf/services/ directorycontains a file for each service whose log files are analyzed by Logwatch. The /usr/share/logwatch/scripts/services/ directory contains the executable scripts run for each service.To configure Logwatch to monitor log files for additional services, create a configurationfile in /etc/logwatch/conf/services/ and a corresponding executable in /etc/logwatch/scripts/services/. You can base the added files on existing files for a different service.20