[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

logwatch question

I am having a problem with logwatch. I am trying to get it to only report what happens in the logs for the previous day. At least for some logs, it isn't doing that.

An example. I rotate the cron log once a week. When I set 'Detail=Med', I noticed that mrtg was running, and I didn't use it, so I removed it from the system (I am running RH 9 with all the current updates). I found that logwatch still reported it as running. I looked at logwatch.conf, and noticed that I had 'Archives = Yes' and 'Range = yesterday'. The cron log doesn't show any mrtg activity since I removed it from the system. This is what logwatch reported today:

--------------------- Cron Begin ------------------------

Commands Run:
   User *system*:
      personal crontab reloaded: 1 Time(s)
   User root:
      /usr/bin/mrtg /etc/mrtg/mrtg.cfg: 24889 Time(s)
      /usr/lib/sa/sa1 1 1: 12816 Time(s)
      /usr/lib/sa/sa2 -A: 89 Time(s)
      run-parts /etc/cron.daily: 89 Time(s)
      run-parts /etc/cron.hourly: 2136 Time(s)
      run-parts /etc/cron.monthly: 3 Time(s)
      run-parts /etc/cron.wednesday: 13 Time(s)
      run-parts /etc/cron.weekly: 13 Time(s)

 ---------------------- Cron End -------------------------

It appears that logwatch is looking at ALL of my archived cron logs, and reporting everything it finds.

Any thoughts on why this is so?


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]