RE: Consolidate logwatch message from all servers to 1 server
"Sharpe, Sam J" <sam.sharpe-AQ/[email protected]>
| Newsgroups | gmane.linux.redhat.release.taroon.general |
|---|---|
| Message-ID | <[email protected]> |
> -----Original Message----- > From: [email protected] > [mailto:[email protected]] On Behalf Of John Haxby > Sent: 14 June 2006 11:35 > To: Discussion of Red Hat Enterprise Linux 3 (Taroon) > Subject: Re: Consolidate logwatch message from all servers to 1 server > > Leuy Eeelyu wrote: > > Hi... My boss want me to consolidate all the logwatch > message from all > > the unix servers into 1 unix servers > > > I usually edit /etc/aliases an add a suitable alias at the > end of the file. The last two lines are normally: I believe what Leuy wants is a single email per day. What you've suggested is an email per-server per-day to a single email account. Logwatch processes log files generated by syslogd. To generate a single email, you should set all of your clients to syslog to a central server. You then run logwatch only on that central server. To set machines to log centrally, edit /etc/syslog.conf and add a line like: *.info @logmachine.example.com On logmachine.example.com you need to start syslogd with the -r switch to enable accepting remote log messages. On RedHat that's simply done by editing /etc/sysconfig/syslog and editing SYSLOGD_OPTIONS="-m 0 -r" as detailed in the comments of that file. As John said, Logwatch is run from /etc/cron.daily - I suggest you either remove the whole package with "rpm -e logwatch" from your syslog clients or you remove the 00-logwatch file from /etc/cron.daily/ On your server, you might want to consider editing the "$Config{'splithosts'} = 0;" line to be "$Config{'splithosts'} = 1;" in /etc/cron.daily/00-logwatch - this will still only send one email, but it will be separated into different sections for each remote host. I don't run logwatch on my syslog server, I run "swatch" which will send an email alert in realtime when the log messages which match defined patterns are seen - you might want to investigate swatch for more realtime log monitoring. -- Sam -- Taroon-list mailing list [email protected] https://www.redhat.com/mailman/listinfo/taroon-list