Logwatch replacement..

Harry Putnam reader at newsguy.com
Sat Jan 8 22:29:13 UTC 2005


Greg Wildman <rhlist at itns.co.za> writes:

> On Fri, 2005-01-07 at 14:33 -0600, Harry Putnam wrote:
>> Anyone here that can recommend a replacement for Logwatch that allows
>> more fine grained user control over what gets reported?
>
> try the --detail option to logwatch or create your own logwatch script
> (s) to report what you want. Look in /etc/log.d

Yes, I know there is some amount of config possible.  what I asked
about was finer grained.  That is, the possible config in logwatch is
not fine grained enough.  Far as I know it does not accept regex for
ignore or include or something similar.

Saying it can be made to `report what you want' is quite a big
exaggeration.

If you've looked at the logwatch HOWTO-Make-Filter file its about the
most confusing piece of mess I've seen for a while.

I doubt I could ever figure out how to write one after taking the
multitude of other steps first that would `report what I want'.

Leaving the dates and times out of reported lines is really not what I
want to see either.  Something logwatch does by default I guess.
I can't imagine when that would ever be usefull.  Assuming logwatch
actually reported something worth my attention, I'm almost certainly
going to want to know EXACTLY when it happened.  And Exactly which log
it was reported in.




More information about the users mailing list