logwatch question
Bill Tangren
bjt at aa.usno.navy.mil
Fri Mar 12 07:11:02 UTC 2004
I am having a problem with logwatch. I am trying to get it to only
report what happens in the logs for the previous day. At least for some
logs, it isn't doing that.
An example. I rotate the cron log once a week. When I set 'Detail=Med',
I noticed that mrtg was running, and I didn't use it, so I removed it
from the system (I am running RH 9 with all the current updates). I
found that logwatch still reported it as running. I looked at
logwatch.conf, and noticed that I had 'Archives = Yes' and 'Range =
yesterday'. The cron log doesn't show any mrtg activity since I removed
it from the system. This is what logwatch reported today:
--------------------- Cron Begin ------------------------
Commands Run:
User *system*:
personal crontab reloaded: 1 Time(s)
User root:
/usr/bin/mrtg /etc/mrtg/mrtg.cfg: 24889 Time(s)
/usr/lib/sa/sa1 1 1: 12816 Time(s)
/usr/lib/sa/sa2 -A: 89 Time(s)
run-parts /etc/cron.daily: 89 Time(s)
run-parts /etc/cron.hourly: 2136 Time(s)
run-parts /etc/cron.monthly: 3 Time(s)
run-parts /etc/cron.wednesday: 13 Time(s)
run-parts /etc/cron.weekly: 13 Time(s)
---------------------- Cron End -------------------------
It appears that logwatch is looking at ALL of my archived cron logs, and
reporting everything it finds.
Any thoughts on why this is so?
TIA,
Bill
More information about the redhat-list
mailing list