Re: Logwatch 7.3.6 Bug?

Starks, Michael wrote:
> Hello Kirk,
> 
> I just upgraded to Logwatch 7.3.6 and noticed something that seems to be 
> a bug which did not exist in the previous 5.x version I was running. 
> 
> I run Logwatch on a central Syslog server and use a simple for loop in a 
> script to parse each hosts log files.  This seems to work well with one 
> caveat: On some hosts, the cron section seems to include commands from 
> the hosts on which Logwatch is run.  To put it another way, the wrong 
> information is in some reports.  I thought it might be a timing issue so 
> I introduced a sleep of 5 and then 10 seconds in the loop, but that 
> didn't help.  I tried the --splithosts option but that didn't help, 
> either.  Finally, searching Google didn't reveal any answers.  I was 
> hoping you could shed some light on this. 
> 
> Here's the loop if it makes a difference:
> 
> for i in $sachosts; do
>   /usr/sbin/logwatch --logdir $saclwloc/$i --hostname $i --save 
> $archdir/$ymd/$i.logwatch.$ymd
> done
> 
> $sachosts are the hosts
> $saclwloc is the base location for each host's logs on the syslog server
> The other variables are probably self-explanatory
> 
> Thanks for a great product and I look forward to hearing from you.
>

This might be a bug in --hostname option or the fact that it is not 
really defined in most conf files. It's on the stack to be reviewed and 
fixed up for the next release.

If you want to try and debug it my first suggestion would be to look at 
the service sections that have the wrong data and then edit the 
<Service>.conf so that it has *OnlyHost listed.

Example from sendmail.conf

# Only give lines pertaining to the sendmail service...
*MultiService = sendmail,sm-mta
*RemoveHeaders


ADD

# Only give lines pertaining to the sendmail service...
*MultiService = sendmail,sm-mta
*RemoveHeaders
*OnlyHost

-Mike