Steps to Setup logwatch on Ubuntu 20.04 LTS

Logwatch is a free & open source system log analyzer. It helps to send the report to mail (recipient user). It generates a details log report which contains sshd – authentication failures, sudo – sessions opened, vsftp failures, postfix, failed logins, & disk space.It display the report on the console. We can be scheduled to run the logwatch command at specific date and time using cron.

There are some steps to setup logwatch on ubuntu:

Step 1: Update the System.

apt-get install

Step 2: Install Logwatch on system.

apt-get install logwatch

  • Here is the command output.

root@ip-172-31-25-13:/home/ubuntu# apt-get install logwatch
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following additional packages will be installed:
libdate-manip-perl postfix ssl-cert
Suggested packages:
libsys-cpu-perl libsys-meminfo-perl procmail postfix-mysql postfix-pgsql postfix-ldap postfix-pcre postfix-lmdb postfix-sqlite sasl2-bin | dovecot-common resolvconf
postfix-cdb mail-reader postfix-doc openssl-blacklist
The following NEW packages will be installed:
libdate-manip-perl logwatch postfix ssl-cert
0 upgraded, 4 newly installed, 0 to remove and 35 not upgraded.
Need to get 2491 kB of archives.
After this operation, 19.7 MB of additional disk space will be used.
Do you want to continue? [Y/n] y

  • Select Internet Site.Click Ok.

  • Provide the system mail name.For example:example.com

  • Check the logwatch version.

logwatch --version

  • Here is the command output.

root@ip-172-31-25-13:/home/ubuntu# logwatch --version
Logwatch 7.5.2 (released 07/22/19)

Step 3: Logwatch Syntax & Example:

  • Runthe following command to display the report.

logwatch

  • Here is the command output.

################### Logwatch 7.5.2 (07/22/19) ####################
Processing Initiated: Sun Nov 21 09:02:15 2021
Date Range Processed: yesterday
( 2021-Nov-20 )
Period is day.
Detail Level of Output: 0
Type of Output/Format: stdout / text
Logfiles for Host: ubuntu
##################################################################
--------------------- Kernel Begin ------------------------
WARNING: Kernel Errors Present
ACPI Error: Aborting method ...: 1 Time(s)
ACPI Error: Thread 24469038 ...: 1 Time(s)
---------------------- Kernel End -------------------------
--------------------- Connections (secure-log) Begin ------------------------
**Unmatched Entries**
systemd-logind: Lid closed.: 4 Time(s)
systemd-logind: Lid opened.: 4 Time(s)
systemd-logind: Operation 'sleep' finished.: 4 Time(s)
systemd-logind: Suspending...: 4 Time(s)
---------------------- Connections (secure-log) End -------------------------
--------------------- Disk Space Begin ------------------------
Filesystem      Size  Used Avail Use%  Mounted on
/dev/nvme0n1p2  234G  26G  196G  12%   /
/dev/loop1       56M  56M   0    100%  /snap/core18/2128
/dev/loop2       62M  62M   0    100%  /snap/core20/1026
/dev/loop3      163M 163M   0    100% /snap/gnome-3-28-1804/145
/dev/loop4       66M 66M   0    100% /snap/gtk-common-themes/1515
/dev/loop0      56M  56M   0    100% /snap/core18/2074
---------------------- Disk Space End -------------------------
--------------------- lm_sensors output Begin ------------------------
iwlwifi_1-virtual-0
Adapter: Virtual device
temp1: +36.0 C
dell_smm-virtual-0
Adapter: Virtual device
fan1: 0 RPM
nvme-pci-0200
Adapter: PCI adapter
Composite: +34.9 C (low = -5.2 C, high = +82.8 C)
(crit = +84.8 C)
ucsi_source_psy_USBC000:001-isa-0000
Adapter: ISA adapter
in0: 5.00 V (min = +5.00 V, max = +5.00 V)
curr1: 0.00 A (max = +0.00 A)
---------------------- lm_sensors output End -------------------------
###################### Logwatch End #########################

  • Run the logwatch command & filter the report.

logwatch --detail high --range yesterday --service vsftpd --service postfix --service zz-disk_space --format text

  • Here is the command output.

################### Logwatch 7.5.2 (07/22/19) ####################
Processing Initiated: Sun Nov 21 09:03:33 2021
Date Range Processed: yesterday
( 2021-Nov-20 )
Period is day.
Detail Level of Output: 10
Type of Output/Format: stdout / text
Logfiles for Host: ubuntu
##################################################################
-------------------- Disk Space Begin ------------------------
Filesystem      Size  Used Avail Use%  Mounted on
/dev/nvme0n1p2  234G  26G  196G  12%   /
/dev/loop1       56M  56M   0    100%  /snap/core18/2128
/dev/loop2       62M  62M   0    100%  /snap/core20/1026
/dev/loop3      163M 163M   0    100% /snap/gnome-3-28-1804/145
/dev/loop4       66M 66M   0    100% /snap/gtk-common-themes/1515
/dev/loop0      56M  56M   0    100% /snap/core18/2074
---------------------- Disk Space End -------------------------
###################### Logwatch End #########################

Step 4: Configure the Logwatch file.

  • Copy the file.

cp /usr/share/logwatch/default.conf/logwatch.conf  /etc/logwatch/conf/

  • Open the logwatch config file.

vim /etc/logwatch/conf/

  • Add the following values:

MailTo = [email protected]
MailFrom = [email protected]
Detail = Low, Med, High, or a number
Service = All
Service = service-name
Range = Yesterday|Today|All
Format = text|html

Where :

MailTo : - Provide the recipient mail-address where to send the report.
MailFrom : Provide the sender email-address.
Detail :- It define the verbosity for the report.
Service : - We can generate the reports for all services or some specific one.
Range : - It define the time duration of the report.
Format : - Report can be text or html format.

Step 5: To Schedule Logwatch using cron job.

  • Open crontab file:

crontab -e

  • Add the following cron job:
  • To schedule logwatch to run every day at 7 AM:

0 7 * * * /sbin/logwatch

Leave a Reply