Logwatch: once a week is enough

If you administer Linux systems, it’s a pretty good idea to keep an eye on the logs. A handy tool that parses your system’s logs and sends you an email report is well known logwatch. By default it sends daily log reports. But to me this is too often. I want weekly reports.

This is how I achieved this on Centos 5.

If they’re not already installed, install logwatch and perl-DateManip

sudo su -
yum install logwatch perl-DateManip

Add a few options to logwatch.conf (I also like my output formatted in html)

echo "Range = between -7 days and -1 days" >> /etc/logwatch/conf/logwatch.conf
echo "Output = html" >> /etc/logwatch/conf/logwatch.conf

By default logwatch installs itself in /etc/cron.daily, you should move it to /etc/cron.weekly

mv /etc/cron.daily/0logwatch /etc/cron.weekly

You can now run a test logwatch and check if it arrives:

/etc/cron.weekly/0logwatch

10 Replies to “Logwatch: once a week is enough”

  1. For those folks who do not have a full OS installed on RHEL5 / Centos5,
    you need a data manipulation perl module to get the ‘-7 days’ to work.
    install Date::Manip by running one of the cmds below and you will be all set.
    cpan -i ‘Date::Manip’
    perl -MCPAN -e ‘install Date::Manip’

    thanks @drye, found this article helpful.

    -Sumanth

  2. Thanks! In the report it still says “period is day”. I assume this has been hardwritten, right?

Comments are closed.