Logwatch Customization Question

Home » CentOS » Logwatch Customization Question
CentOS 2 Comments

Logwatch is installed, and I am assuming by how empty /etc/logwatch is that it is running from defaults, which I find in
/usr/share/logwatch/default.conf/services

I want to customize ONE service. dovecot.

Do I copy /usr/share/logwatch/default.conf/services/dovecot.conf

to

/etc/logwatch/conf/services

and edit it there,

or do I have to copy ALL default.conf/services/* there and modify
/etc/logwatch/conf/logwatch.conf to look there?

The README is rather not helpful on this.

How do I modify ONE service (and not just make the changes in default.conf that I have seen in a couple howtos.

thanks

2 thoughts on - Logwatch Customization Question

  • I think that the HOWTO, referenced in the logwatch man page, has a fairly complete explanation of approaches to customization.

    CentOS-6/logwatch-7.3.6

    MORE INFORMATION
    The directory /usr/share/doc/logwatch-* contains several
    files with additional documentation:
    HOWTO-Customize-LogWatch
    Documents the directory structure of Logwatch
    configuration and executable files, and describes how
    to customize Logwatch by overriding these default files.

    CentOS-7/logwatch-7.4.0

    In addition to the HOWTO, as in -6, there’s also a logwatch.conf man page, which includes:

    override.conf – ( /etc/logwatch/conf/override.conf ) contains
    the settings which overrides the standard configuration of
    specific log files or services. The syntax is the same as in
    log/service files.

  • thanks. I think I got it from the sendmail example.

    ” For example, if file /etc/logwatch/conf/services/sendmail.conf has the
    single entry:
    $sendmail_unknownusersthreshold = 5
    then the threshold for unknown users is set to five instead of the
    default of one. All other parameters are not modified. “

    thus:

    cat > /etc/logwatch/conf/services/dovecot.conf
    # Override the default Detail level. This will only affect dovecot’s report.
    $dovecot_detail = 10

    I will see how it goes after tonight!