logwatch - system log analyzer and reporter
SYNOPSIS
logwatch [--detail level ] [--logfile log-file-group ]
[--service service-name ] [--print] [--mailto address ]
[--archives] [--range range ] [--debug level ] [--save
file-name ] [--help|--usage]
DESCRIPTION
LogWatch is a customizable, pluggable log-monitoring sys
tem. It will go through your logs for a given period of
time and make a report in the areas that you wish with the
detail that you wish. Easy to use - works right out of
the package on almost all systems.
OPTIONS
--detal level
This is the detail level of the report. level can
be high, med, low.
--logfile log-file-group
This will force LogWatch to process only the set of
logfiles defined by log-file-group (i.e. messages,
xferlog, ...). LogWatch will therefore process all
services that use those logfiles. This option can
be specified more than once to specify multiple
logfile-groups.
--service service-name
This will force LogWatch to process only the ser
vice specified in service-name (i.e. login, pam,
identd, ...). LogWatch will therefore also process
any log-file-groups necessary to process these ser
vices. This option can be specified more than once
to specify multiple services to process. A useful
service-name is All which will process all services
(and logfile-groups) for which you have filters
installed.
--print
Print the results to stdout (i.e. the screen).
--mailto address
Mail the results to the email address or user spec
ified in address.
--archives
Each log-file-group has basic logfiles (i.e.
/var/log/messages) as well as archives (i.e.
/var/log/messages.? or /var/log/messages.?.gz).
This option will make LogWatch search through the
archives in addition to the regular logfiles. The
entries must still be in the proper date range (see
--range range
You can specify a date-range to process. This
option is currently limited to only Yesterday,
Today and All.
--debug level
For debugging purposes. level can range from 0 to
100. This will really clutter up your output. You
probably don't want to use this.
--save file-name
Save the output to file-name instead of displaying
or mailing it.
--usage
Displays usage information
--help same as --usage.
FILES
/etc/log.d/logwatch.conf
Really a symlink to /etc/log.d/conf/logwatch.conf.
This file sets the default values of all the above
options. These defaults are used when LogWatch is
called without any parameters (i.e. from
cron.daily). The file is well-documented, but the
explanations above also apply to this config file.
/etc/log.d/conf/services/*
Configuration files for the various services whose
log entries LogWatch can process.
/etc/log.d/conf/logfiles/*
Configuration files for the various logfiles that
the above service's log entries are stored in.
/etc/log.d/scripts/shared/*
Filters common to many services and/or logfiles.
/etc/log.d/scripts/logfiles/*
Filters specific to just particular logfiles.
/etc/log.d/scripts/services/*
Actual filter programs for the various services.
EXAMPLES
logwatch --service ftpd-xferlog --range all --detail high
--print --archives
This will print out all FTP transfers that are
stored in all current and archived xferlogs.
logwatch --service pam_pwdb --range yesterday --detail
high --print
This will print out login information for the pre
vious day...
BUGS
The --range option is very weak... this will be fixed in
AUTHOR
Kirk Bauer <kirk@kaybee.org>
http://www.kaybee.org/~kirk
ftp://ftp.kaybee.org/pub/redhat/RPMS
Man(1) output converted with
man2html