Customizing Logwatch

There are two basic customizations we often perform:

1. increase the header-information with machine-specific info (hardware, admininstrator(s), usage, etc):
2. adjust the order of the information - we care very much about disk-usage, and prefer it first

Start by ensuring logwatch is actually installed! A mail-transport agent (MTA) like Postfix must be installed and working (to receive the daily logwatch summary).

Logwatch Headers

Use this template, to create /usr/share/logwatch/custom_header (ASCII, plain-text file; previous Gentoo and other distributions used /etc/log.d/custom_header).

Machine info:  Pentium4 2.4GHz, 1GB, GigE, 40GB+120GB, RivaTNT
 Running RedHat 9 Linux
 Located in Research Server Room A (Beta Space, Surrey Campus)
 Used by John Doe <john_doe@sfu.ca>
 Into service xxx.  Re-purposed Dec. 15, 2004
 Administered by Gordon Pritchard <gordonp+corsair@sfu.ca>

Another example:

Machine info:  Pentium4 dual-core 3GHz, 2GB, GigE, 80GB, ATI-R300-mobility
 Running Gentoo Linux
 Located in office  525 / The Axis (Beta Space, Surrey Campus)
 Used by Gordon Pritchard <gordonp+zero@sfu.ca)
 Into service September 6, 2005.
 Administered by Gordon Pritchard <gordonp+zero@sfu.ca>

To include this custom header, we now have to modify the main logwatch Perl script logwatch.pl to add the bold / red line:

• on a Gentoo machine, this file is /usr/sbin/logwatch.pl:

      outline( $index_par, "\n ################### LogWatch $Version ($VDate) #################### \n");
  }
  outline( $index_par, "       Processing Initiated: " . localtime(time) . "\n");
  outline( $index_par, "       Date Range Processed: $Config{'range'}\n");
  outline( $index_par, "                             $print_range\n") if ($Config{'range'} ne 'all');
  outline( $index_par, "                             Period is " . GetPeriod() . ".\n")
     if ($Config{'range'} ne 'all');
  outline( $index_par, "     Detail Level of Output: $Config{'detail'}\n");
  outline( $index_par, "             Type of Output: $Config{'output'}\n");
  outline( $index_par, "          Logfiles for Host: $Config{'hostname'}\n");
  outline( $index_par, "\n" . `/bin/cat  $BaseDir/custom_header` .  "\n");
 
  if ( $outtype_html or $outtype_htmlembed ) {
  outline( $index_par, "\n");
  } else {
  outline( $index_par, "################################################################## \n");

• on a RedHat 9 machine, this file is /etc/log.d/scripts/logwatch.pl:

   $printing = 'y';
   print OUTFILE "\n ################### LogWatch $Version ($VDate) #################### \n";
   print OUTFILE "       Processing Initiated: " . localtime(time) . "\n";
   print OUTFILE "       Date Range Processed: $Config{'range'}\n";
   print OUTFILE "     Detail Level of Output: $Config{'detail'}\n";
   print OUTFILE "          Logfiles for Host: $Config{'hostname'}\n";
   print OUTFILE "\n" . `/bin/cat  $BaseDir/custom_header` .  "\n";
   print OUTFILE "################################################################ \n\n";
}

Lately, it's been more-difficult to remember which machines have up-to-date kernels, so we want logwatch to assist us, by printing the kernel-version in the header. Using a Gentoo example, it's a one-line addition:

      outline( $index_par, "\n ################### LogWatch $Version ($VDate) #################### \n");
  }
  outline( $index_par, "       Processing Initiated: " . localtime(time) . "\n");
  outline( $index_par, "       Date Range Processed: $Config{'range'}\n");
  outline( $index_par, "                             $print_range\n") if ($Config{'range'} ne 'all');
  outline( $index_par, "                             Period is " . GetPeriod() . ".\n")
     if ($Config{'range'} ne 'all');
  outline( $index_par, "     Detail Level of Output: $Config{'detail'}\n");
  outline( $index_par, "             Type of Output: $Config{'output'}\n");
  outline( $index_par, "          Logfiles for Host: $Config{'hostname'}\n");
  outline( $index_par, "                     Kernel: " . `/bin/uname -r` . "\n");
  outline( $index_par, "\n" . `/bin/cat  $BaseDir/custom_header` .  "\n");

Logwatch Information Order

The scripts located in /etc/log.d/scripts/services/ are run according to their file-name ordering. Simply renaming a file changes it's relationship to other information. We should move zz-disk_space to aa-disk_space to have our disk-usage appear right after the custom header; as root:

zero services # mv /usr/share/logwatch/scripts/services/zz-disk_space /usr/share/logwatch/scripts/services/aa-disk_space

The following is no longer necessary for current Gentoo systems; they *always* print the disk-usage

But wait - there's more!! This disk-space script evolves through the various releases, often suppressing output if nothing prior is printed. And, (now) as the first entry, nothing prior will ever get printed :-O So, we'll strip out all the conditionals, and produce a pared-down script /etc/log.d/scripts/services/aa-disk_space which forever more will always give us our disk-usage as the first thing:

Gentoo:

#!/bin/bash
##########################################################################
# $Id: aa-disk_space,v 1.8 2005/02/24 17:08:05 kirk Exp $
##########################################################################
 
    echo
    df -hP | head -n1; df -hP | grep '^[/ ]'

RedHat 9:

#!/bin/bash
##########################################################################
# $Id: disk_space,v 1.1 2003/01/13 04:00:59 kirk Exp $
##########################################################################
 
   echo
   echo
   echo "------------------ Disk Space --------------------"
   echo
   df -h
   echo

One more thing to do - there is a corresponding configuration file which we simply move (rename) to align with the above:

• Gentoo shown; earlier Gentoo and RedHat 9 had these files at /etc/log.d/conf/services/zz-disk_space.conf and /etc/log.d/scripts/services/zz-disk_space

zero # mv /usr/share/logwatch/default.conf/services/zz-disk_space.conf /usr/share/logwatch/default.conf/services/aa-disk_space.conf

To test it all, invoke the daily logwatch cron-job manually (Gentoo shown; others similar):

zero # sh /etc/cron.daily/00-logwatch