logwatch - system log analyzer and reporter


SYNOPSIS

       logwatch  [--detail  level  ]  [--logfile log-file-group ]
       [--service service-name ] [--print]  [--mailto  address  ]
       [--archives]  [--range  range  ]  [--debug level ] [--save
       file-name ] [--help|--usage]


DESCRIPTION

       LogWatch is a customizable, pluggable log-monitoring  sys­
       tem.   It  will go through your logs for a given period of
       time and make a report in the areas that you wish with the
       detail  that  you  wish.  Easy to use - works right out of
       the package on almost all systems.


OPTIONS

       --detal level
              This is the detail level of the report.  level  can
              be high, med, low.

       --logfile log-file-group
              This will force LogWatch to process only the set of
              logfiles defined by log-file-group (i.e.  messages,
              xferlog, ...).  LogWatch will therefore process all
              services that use those logfiles.  This option  can
              be  specified  more  than  once to specify multiple
              logfile-groups.

       --service service-name
              This will force LogWatch to process only  the  ser­
              vice  specified  in  service-name (i.e. login, pam,
              identd, ...).  LogWatch will therefore also process
              any log-file-groups necessary to process these ser­
              vices.  This option can be specified more than once
              to  specify multiple services to process.  A useful
              service-name is All which will process all services
              (and  logfile-groups)  for  which  you have filters
              installed.

       --print
              Print the results to stdout (i.e. the screen).

       --mailto address
              Mail the results to the email address or user spec­
              ified in address.

       --archives
              Each   log-file-group   has  basic  logfiles  (i.e.
              /var/log/messages)  as  well  as   archives   (i.e.
              /var/log/messages.?   or   /var/log/messages.?.gz).
              This option will make LogWatch search  through  the
              archives  in addition to the regular logfiles.  The
              entries must still be in the proper date range (see


       --range range
              You  can  specify  a  date-range  to process.  This
              option is  currently  limited  to  only  Yesterday,
              Today and All.

       --debug level
              For  debugging purposes.  level can range from 0 to
              100.  This will really clutter up your output.  You
              probably don't want to use this.

       --save file-name
              Save  the output to file-name instead of displaying
              or mailing it.

       --usage
              Displays usage information

       --help same as --usage.


FILES

       /etc/log.d/logwatch.conf
              Really a symlink to  /etc/log.d/conf/logwatch.conf.
              This  file sets the default values of all the above
              options.  These defaults are used when LogWatch  is
              called    without   any   parameters   (i.e.   from
              cron.daily).  The file is well-documented, but  the
              explanations  above also apply to this config file.
       /etc/log.d/conf/services/*
              Configuration files for the various services  whose
              log entries LogWatch can process.
       /etc/log.d/conf/logfiles/*
              Configuration  files  for the various logfiles that
              the above service's log entries are stored in.
       /etc/log.d/scripts/shared/*
              Filters common to many services and/or logfiles.
       /etc/log.d/scripts/logfiles/*
              Filters specific to just particular logfiles.
       /etc/log.d/scripts/services/*
              Actual filter programs for the various services.


EXAMPLES

       logwatch --service ftpd-xferlog --range all --detail  high
       --print --archives
              This  will  print  out  all  FTP transfers that are
              stored in all current and archived xferlogs.
       logwatch --service  pam_pwdb  --range  yesterday  --detail
       high --print
              This  will print out login information for the pre­
              vious day...


BUGS

       The --range option is very weak... this will be  fixed  in



AUTHOR

       Kirk Bauer <kirk@kaybee.org>

       http://www.kaybee.org/~kirk

       ftp://ftp.kaybee.org/pub/redhat/RPMS


Man(1) output converted with man2html