http / apache

/usr/share/logwatch/default.conf/logfiles/http.conf:
> ########################################################
> #   Define log file group for httpd 
> ########################################################
> 
> # What actual file?  Defaults to LogPath if not absolute path....
> LogFile = httpd/*access_log
> LogFile = apache/*access.log.1
> LogFile = apache/*access.log
> LogFile = apache2/*access.log.1
> LogFile = apache2/*access.log
> LogFile = apache-ssl/*access.log.1
> LogFile = apache-ssl/*access.log

I noticed the error log is absent. That seems a bit odd, as the primary 
focus of the logwatch filter should be reporting errors. That means 
lines like:

[Sun Jul  1 06:52:52 2007] [error] (2)No such file or directory: 
mod_mime_magic: can't read magic file /usr/share/misc/file/magic.mime

that don't show up in the access log will be missed.

I'm not sure how best to correct for this, as the format is different 
and thus simply can't be added to the above list. I suppose a new log 
file group, apache_error, could be created, with a format converter to 
feed into the existing http service filter. A bit less than ideal, as it 
blends error logs with everything else, which the service filter would 
only have to then try and separate.

The error log might also be tricky to handle due to it containing 
potentially arbitrary text with no headers written by CGI programs. 
Often these lines contain only debugging information and can be ignored, 
but on a production server that might not be the case, and you might 
want to report all headerless lines as errors.

By the way, why is the group and service called 'http' if it is 
Apache-specific?

  -Tom

-- 
Tom Metro
Venture Logic, Newton, MA, USA
"Enterprise solutions through open source."
Professional Profile: http://tmetro.venturelogic.com/