LOGWATCH(8)

📦
version 7.15 · 6 versions
, in arch rolling, fedora 43, fedora 44, ubuntu stonking

💖 LOGWATCH — the logwatch(8) page, bestie edition 💖

okay so you opened the system log analyzer manpage, and honestly? iconic choice. this is logwatch, section 8 of the User Manuals, and she's about to become your new best friend. grab a strawberry drink 🍓 and let's go.

✨ NAME ✨

logwatch — system log analyzer and reporter 🦋

like. she reads your logs. she writes you a report. that's the whole vibe.

🌸 SYNOPSIS 🌸

logwatch [--detail level ] [--logfile log-file-group ] [--service
service-name ] [--mailto address ] [--noarchives] [--range range ]
[--debug level ] [--filename file-name ] [--logdir directory ]
[--hostlimit hosts ] [--hostname hostname ] [--html_wrap number of
characters ] [--hostformat host based options ] [--output output-type ]
[--format report format ] [--subject email subject ] [--encode encoding
to use ] [--numeric] [--version] [--help|--usage]

no cap, that's the whole menu. every single flag below is real and every single one matters 💅

💜 DESCRIPTION 💜

Logwatch is a customizable, pluggable log-monitoring system. she'll go through your logs for a given period of time and make a report in the areas that you wish, with the detail that you wish. main character energy, honestly — she only talks about what you asked about.

she's being used for Linux and many types of UNIX. fr fr, she gets around. 🌈

🎀 OPTIONS 🎀

  • --detail level — this is the detail level of the report, aka how much she's gonna yap. level can be a positive integer, or high, med, low, which correspond to the integers 10, 5, and 0, respectively. so high = 10, med = 5, low = 0. math is math 💅
  • --logfile log-file-group — this forces Logwatch to process only the set of logfiles defined by log-file-group (i.e. messages, xferlog, ...). she'll therefore process all services that use those logfiles. you can specify this option more than once to specify multiple logfile-groups — stack 'em, bestie 🫶
  • --service service-name — this forces Logwatch to process only the service specified in service-name (i.e. login, pam, identd, ...). she'll therefore also process any log-file-groups necessary to process these services. can be specified more than once to specify multiple services to process. a very useful service-name is All, which will process all services (and logfile-groups) for which you have filters installed. All is the greedy girlie and we love her 👑
  • --mailto address — mail the results to the email address or user specified in address. inbox delivery, periodt 💌
  • --range range — you can specify a date-range to process. common ranges are Yesterday, Today, All, and Help. additional options are listed when invoked with the Help parameter. so like, ask her for Help and she'll spill the whole list ✨
  • --noarchives — each log-file-group has basic logfiles (i.e. /var/log/messages) as well as archives (i.e. /var/log/messages.? or /var/log/messages.?.gz). by default, Logwatch will search through the archives in addition to the regular logfiles. for values of --range other than "all", Logwatch will search the appropriate archived logs. if "--noarchives" is specified, Logwatch will not search the archived logs for any value of "--range". so this one is the "don't dig through the old stuff" button 🗄️
  • --debug level — for debugging purposes. level typically ranges in value from 0 to 100. this will clutter up your output, so you probably only want to use this when debugging. values of 100 or more will retain the temporary files (by default, created under /var/cache/logwatch, unless specified as tmpdir in the logwatch.conf file). > heads up: this one gets messy on purpose, that's the point. also 100+ leaves temp files behind, so don't be shocked when they're still there 💀
  • --filename file-name — save the output to file-name instead of displaying or mailing it. quiet girlie behavior, respect 🙈
  • --logdir directory — look in directory for log subdirectories or log files first before looking in the default directories. VIP entrance only 💅
  • --hostlimit host1,host2 — limit report to hostname - host1, host2. keep it exclusive, bestie ✂️
  • --hostname hostname — use hostname for the reports instead of this system's hostname. in addition, if HostLimit is set in the logwatch.conf configuration file (see MORE INFORMATION, below), then only logs from this hostname will be processed (where appropriate). she'll wear the name you gave her 🎀
  • --html_wrap num-characters — number of characters that html output should be wrapped to. default is 80. cute little line breaks for your cute little html 🌸
  • --hostformat split — use split approach when formatting report for multiple hosts — none [default], split, splitmail. three flavors, pick your fave 🍓
  • --output output-type — report using output-type — stdout [default], mail, file. where does the report go? you decide, queen 👑
  • --format format — format report using format — text [default], html. plain girl or glowed-up girl, both valid ✨
  • --subject email-subject — customize the email subject sent by Logwatch. option --output must be set to mail. > yes, you actually have to set --output mail for this to matter. she's not gonna customize a subject for a report that never gets mailed 💅
  • --encode encoding — encode report using encoding — none [default], base64, 7bit, 8bit [same as 'none']. note that 8bit is literally the same as none, no cap 🌈
  • --numeric — inhibits additional name lookups, displaying IP addresses numerically. no name-dropping, just the raw digits 🔢
  • --usage — displays usage information. she tells you how to use her. very communicative 🫶
  • --help — same as --usage. literally the same thing, twins 💜

🦋 FILES 🦋

  • /usr/share/logwatch/ — this directory contains all the perl executables and configuration files shipped with the logwatch distribution. the og home base 🏠
  • /etc/logwatch — this directory contains local configuration files that override the default configuration. see MORE INFORMATION below for more information. this is where you get to have opinions, bestie 💅

⭐ EXAMPLES ⭐

logwatch --service ftpd-xferlog --range all --detail high

this will print out all FTP transfers that are stored in all current and archived xferlogs. every single one. she's thorough like that 🔥

logwatch --service pam_pwdb --range yesterday --detail high

this will print out login information for the previous day... yesterday's tea, served today ☕

🌈 MORE INFORMATION 🌈

the directory /usr/share/doc/logwatch-* contains several files with additional documentation:

  • HOWTO-Customize-LogWatch — documents the directory structure of Logwatch configuration and executable files, and describes how to customize Logwatch by overriding these default files. the glow-up guide 📖
  • LICENSE — describes the License under which Logwatch is distributed. additional clauses may be specified in individual files. read it, it's giving legally-binding ✨
  • README — describes how to install, where to find it, mailing lists, and other useful information. the starter pack 🎀

👑 AUTHOR 👑

Kirk Bauer <kirk@kaybee.org> http://sourceforge.net/projects/logwatch

the icon who built her 🫶

and that's the whole page, bestie. this one shipped on Linux, dated May 2012, and it's still out here analyzing logs like the queen she is. go forth and --detail high responsibly 💖✨🎀

📦 where this page comes from