Re: Consolidate logwatch message from all servers to 1 server
"Stephen John Smoogen" <[email protected]>
| Newsgroups | gmane.linux.redhat.release.taroon.general |
|---|---|
| Message-ID | <[email protected]> |
On 6/14/06, Leuy Eeelyu <sarawakbird-/[email protected]> wrote: > Hi... My boss want me to consolidate all the logwatch > message from all the unix servers into 1 unix servers. > > My question are > 1)How is Logwatch collect the message? What will be > recorded in Logwatch? I always receive the mail sent > to root by Logwatch, may I know what is controlling > the frequency ?? > Hi, Leuy, the question is a bit confusing.. I am not sure if I am translating correctly. Logwatch is a program that goes through the various logs in /var/log and comes up with a summary report. If you are wanting to have all your logwatch summary emails go to one machine then you are needing to set up an email routing mechanism where all root emails get sent to some central list/person/etc. If you are wanting to centralize your 'syslog' messages and then have your syslog server run one logwatch you will need to a) set up the syslog server, b) change /etc/syslog.conf on each machine to point to that server, and c) probably update the logwatch on that server to a newer version of logwatch than came with RHEL-3/RHEL-4. I never could get a nice output from logwatch on a centralized server. -- Stephen J Smoogen. CSIRT/Linux System Administrator -- Taroon-list mailing list [email protected] https://www.redhat.com/mailman/listinfo/taroon-list