A few logwatch questions

[Ed Wilts]

On Wed, Oct 19, 2005 at 08:40:18AM -0400, Shane Presley wrote:
> Also, on some of our Solaris servers we run an hourly script to report
> any "unknown" events in /var/adm/messages.  It checks it against an
> ignore list, and e-mails out any new log entries that aren't on the
> ignore list.  Can logwatch do that?

This is one of the things I *hate* about logwatch.  Our policy here is
to throw away logwatch and go back to logcheck which does exactly what
you're asking for.

I've seen this catch a lot of things that suddenly pop up in a message
file that are unexpected.

http://logcheck.org/

-- 
Ed Wilts, RHCE
Mounds View, MN, USA
mailto:ewilts at ewilts.org
Member #1, Red Hat Community Ambassador Program