RE: Consolidate logwatch message from all servers to 1 server

John Haxby Wrote: 
> Sharpe, Sam J wrote:
> > I believe what Leuy wants is a single email per day. What you've 
> > suggested is an email per-server per-day to a single email account.
> >
> > Logwatch processes log files generated by syslogd. To generate a 
> > single email, you should set all of your clients to syslog 
> to a central server.
> > You then run logwatch only on that central server.
> >   
> Logwatch does more than syslog though ... it reports on all kinds of 
> things.   You could merge all the logwatch messages into a single 
> message, but you'd need log watch to do it's information 
> gathering and then send the summary to a central place which 
> could wrap it all up so you could get a single message.

Hmmm... I looked at /etc/log.d/logwatch.conf and everything it was
talking about was /var/log/messages - you're right in that the scripts
in /etc/log.d/scripts/services/ can (and do) process different logs. In
the default RedHat configuration I've only seen it parse our syslog
generated logs - perhaps I'm wrong though.

> I know Leuy was asking for a single message, but I don't 
> think it's possible with logwatch, but I'm guessing that 
> what's actually needed is all the messages in one place so 
> you don't have to log in to each system to get the mail message.

Yeah - central syslogging is the way forward... We preferred swatch over
logwatch because it continually parses the logs looking for matches and
alerts immediately. We also run syslog-ng on the loghost rather than
syslog because we send everything to one file to be caught by swatch but
also archive and rotate the logs by hostname/service in a directory
structure. Syslog-ng is much better at this. Immediate short swatch
emails are much better than having to manually read a huge report
per-day ;o) (even if you do get 10 or 20 of them)

--
Sam

--
Taroon-list mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/taroon-list