Linux Configure Logwatch on the Central Log Server

Logwatch is a utility that is used to monitor and analyze log files on a Linux system. It can be configured to run on a central log server to collect and process log data from multiple systems.

To configure Logwatch on a central log server, you can follow these steps:

1. Install Logwatch on the central log server:

$ sudo apt-get install logwatch

This will install the Logwatch package and the necessary dependencies.

2. Configure the log sources for Logwatch. By default, Logwatch is configured to process log files from the local system. To configure Logwatch to process log files from other systems, you will need to specify the log sources in the /usr/share/logwatch/default.conf/logwatch.conf file.

To specify a log source, you will need to add a LogDir line to the logwatch.conf file, followed by the path to the log files on the remote system. For example:

LogDir = /var/log
LogDir = ssh://user@remote-system:/var/log

This will tell Logwatch to process the log files from the local system (/var/log) and from the remote system (ssh://user@remote-system:/var/log).

3. Configure the log processing options for Logwatch. You can customize the log processing options for Logwatch by modifying the logwatch.conf file. Some options that you may want to consider include:

• MailTo: This option specifies the email address that the log report should be sent to.
• Output: This option specifies the format of the log report (e.g., mail, stdout, html, text).
• Detail: This option specifies the level of detail to include in the log report (e.g., Low, Med, High, All).
• Service: This option specifies the services to include in the log report (e.g., http, ftp, ssh, mail).

4. Test the Logwatch configuration. You can test the Logwatch configuration by running the logwatch command with the --debug option:

$ logwatch --debug

This will generate a log report with debugging information, which can help you identify any issues with the Logwatch configuration.

5. Set up a cron job to run Logwatch on a regular basis. To run Logwatch on a regular basis, you can set up a cron job to execute the logwatch command. For example, to run Logwatch every day at midnight, you can add the following line to the crontab file:

0 0 * * * logwatch

This will run the logwatch command every day at midnight. The log report will be generated and sent to the email address specified in the MailTo option in the logwatch.conf file.