Tearabite

I used to get a daily "logwatch" email, with all my other cron job stuff. I still get the backup, and a few other cron email notifications, but the LogWatch doesnt come anymore..

How/what/where can i check/configure this??

jdcopelin

Hi,

This happened to my dedi when I first got it... hopefully the info below will help you solve it:

1. logwatch gets its info from various log files, usually in /var/log. You need to make sure that "syslogd" is running for those logs to get filled up... so restart the service with this command:

/etc/init.d/syslog restart

2. Check the size of your log files with this command

ls -l /var/log/messages*

It can take a few hours to fill them up.

3. Also check that the service manager in your whm ( under Service Configuration ) is set to restart syslogd if it fails.

Hope this helps.

Regards
Jonathan

__________________
Server: Pass32 and dedicated server

Tearabite

Thank you JD;
SyslogD was running, and is set to be monitored and restarted. I restarted it with the restart command as you suggested anyway.
Not really sure what I should be looking for by looking at the size of the log though..
I guess i'll see if it's working now at 2am tomorrow morning..

jdcopelin

Looking at the size of the logs should tell you whether there is anything in them and also when they were last modified. If the date is recent then they are being written to by syslogd correctly. Sorry I didn't explain that before

However, if syslogd was already running, perhaps something else could be wrong. As you say, you will know at 2am whether it is working again.

Cheers
Jonathan

__________________
Server: Pass32 and dedicated server

Kayla

Waiting.

__________________

Tearabite

Ok - i got a LOGWATCH BUT...

It's truncated, like a summary only. This shorter version is fine, but how/why would it change??

jdcopelin

Hello,

When you say "truncated" what do you mean exactly? I take it to mean that only disk usage and ip routing information are in the report (this is what happened to me), whereas normally you get IMAP/POP access, hackers, SSH, cron, etc.

What happens when you run logwatch manually with the command below?
If this command produces a very simple report then either your server is very quiet (unlikely) or there is still a problem with syslogd. A report that is rather long might indicate that the logwatch.conf file has been altered.

I suggest you open a ticket (if you haven't already) because the solution to your problem obviously isn't the same as it was for me.

Best wishes
Jonathan

__________________
Server: Pass32 and dedicated server

Tearabite

I guess truncated is the wrong word - it's a summary that i'm getting now.
previously I got a 10 page listing of every hack-attempt for example, showing the time, ip, password used, ect.
Now all i get is "xx.xx.xx.xx 10 failed login attempts"
I tried your command but never got the email.
I was able to look at the /var/messages.1 file and it looks different than before - now it's showing FQDN's for my hack attempts instead of IP's - so something has changed and goodness knows it wasnt me that changed it (i'm too clueless) ..

Support-ticket time i guess

jdcopelin

Sorry I couldn't be of more help to you. Please let us know how you get on.

Have a Happy Christmas

Regards
Jonathan

__________________
Server: Pass32 and dedicated server