logwatch -save option

[Bob McClure Jr]

On Fri, Aug 05, 2005 at 09:06:20AM -0600, redhat at buglecreek.com wrote:
> I'm trying to setup logwatch to save it's output to /tmp/logwatch.`date
> +%F`.  I have modified the save option in logwatch.conf with
> /tmp/logwatch.`date +%F`, but it does not seem to recognize bash
> command substitution.  Maybe because it is written in perl?

Nope.  It's just a config file - not executed as such.  It's read by
logwatch which uses simple parsing rules.

> Does anyone know of a way to accomplish this?

If logwatch is executed from /etc/cron.daily/0logwatch, as it is on my
machine, I'd set the config to save to /tmp/logwatch.  Then I'd create
a script, say, /etc/cron.daily/1logwatch so it executes after
0logwatch, like this:

-----------------8< snip here ----------------
#!/bin/sh
lwfile=/tmp/logwatch
if [ -f $lwfile ]
then mv $lwfile $lwfile.`date +%F`
fi
-----------------8< snip here ----------------

Don't forget to

  chmod +x /etc/cron.daily/1logwatch

> Am I missing something obvious?   

Nope.  The only way you can be reasonably sure that a file is executed
and not simply read and parsed, is to look for a "sh-bang" (#!) line
at the top.  If you do "ls -l <filename>" and it shows up without
execute bits set, then it is not executed (there are exceptions such
as "sourced" or "require"d files).  In this case you get

lrwxrwxrwx  1 root root 18 Jun 25 21:38 /etc/log.d/logwatch.conf -> conf/logwatch.conf

Now that's not executable (the "x" flags) - it's just a symbolic link
(symlink or soft link) to the real file at
/etc/log.d/conf/logwatch.conf:

-rw-r--r--  1 root root 3758 May 17 08:36 /etc/log.d/conf/logwatch.conf

and there you see it's not executable.

> Since sendmail is turned off on our systems, this would at least let us
> view the logwatch output until a better solution can be made. 
> 
> Thanks

Cheers,
-- 
Bob McClure, Jr.             Bobcat Open Systems, Inc.
robertmcclure at earthlink.net  http://www.bobcatos.com
God doesn't have (or need) a Plan B.