This document is an older, unmaintained guide. There may be a new guide available for this software.
Logwatch is a utility used to monitor system logs and create reports. These reports include failed login attempts, successful login attempts, and storage space used/available.
Before installing Logwatch, it is assumed that you have followed our getting started guide. If you're new to Linux server administration, you may be interested in our using Linux document series including the beginner's guide and administration basics guide.
You will need to make sure that your system and installed packages are up to date by issuing the following command:
Once this has completed, you are ready to install Logwatch.
Issue the following command to install Logwatch:
yum install logwatch
Once you have installed Logwatch, you will need to configure it to email you the reports it generates. You are encouraged to look through the entire configuration, but you may safely use Logwatch after editing the lines below.
MailTo = email@example.com MailFrom = firstname.lastname@example.org
The MailTo and MailFrom directives should be valid email addresses.
Issue the following command to test your logwatch installation:
Once you have issued this command, you will need to check your email to make sure that logwatch is working. Be sure to check your spam folder as these emails may be seen as spam.
You can add a cron job for Logwatch in order to receive daily emails of new reports. You can add a new entry to your crontab by running crontab -e. The following example cron job runs Logwatch at 1 AM each day, issuing you an email report of the daily activity:
# m h dom mon dow command 0 1 * * * /usr/sbin/logwatch
Congratulations! You can now monitor system logs with Logwatch!
This guide is licensed under a Creative Commons Attribution-NoDerivs 3.0 United States License.
Last edited by Matthew Cone on Monday, October 8th, 2012 (r3103).