|
Packit |
57988d |
.\" Process this file with
|
|
Packit |
57988d |
.\" groff -man -Tascii foo.1
|
|
Packit |
57988d |
.\"
|
|
Packit |
57988d |
.TH LOGWATCH 8 "May 2012" Linux "User Manuals"
|
|
Packit |
57988d |
.SH NAME
|
|
Packit |
57988d |
logwatch \- system log analyzer and reporter
|
|
Packit |
57988d |
.SH SYNOPSIS
|
|
Packit |
57988d |
.B logwatch [--detail
|
|
Packit |
57988d |
.I level
|
|
Packit |
57988d |
.B ] [--logfile
|
|
Packit |
57988d |
.I log-file-group
|
|
Packit |
57988d |
.B ] [--service
|
|
Packit |
57988d |
.I service-name
|
|
Packit |
57988d |
.B ] [--mailto
|
|
Packit |
57988d |
.I address
|
|
Packit |
57988d |
.B ] [--archives] [--range
|
|
Packit |
57988d |
.I range
|
|
Packit |
57988d |
.B ] [--debug
|
|
Packit |
57988d |
.I level
|
|
Packit |
57988d |
.B ] [--filename
|
|
Packit |
57988d |
.I file-name
|
|
Packit |
57988d |
.B ] [--logdir
|
|
Packit |
57988d |
.I directory
|
|
Packit |
57988d |
.B ] [--hostlimit
|
|
Packit |
57988d |
.I hosts
|
|
Packit |
57988d |
.B ] [--hostname
|
|
Packit |
57988d |
.I hostname
|
|
Packit |
57988d |
.B ] [--html_wrap
|
|
Packit |
57988d |
.I number of characters
|
|
Packit |
57988d |
.B ] [--hostformat
|
|
Packit |
57988d |
.I host based options
|
|
Packit |
57988d |
.B ] [--output
|
|
Packit |
57988d |
.I output-type
|
|
Packit |
57988d |
.B ] [--format
|
|
Packit |
57988d |
.I report format
|
|
Packit |
57988d |
.B ] [--encode
|
|
Packit |
57988d |
.I encoding to use
|
|
Packit Service |
d574e7 |
.B ] [--numeric] [--no-oldfiles-log] [--version] [--help|--usage]
|
|
Packit |
57988d |
.SH DESCRIPTION
|
|
Packit |
57988d |
.B Logwatch
|
|
Packit |
57988d |
is a customizable, pluggable log-monitoring system. It will go
|
|
Packit |
57988d |
through your logs for a given period of time and make a report in the areas
|
|
Packit |
57988d |
that you wish with the detail that you wish. Logwatch is being used for
|
|
Packit |
57988d |
Linux and many types of UNIX.
|
|
Packit |
57988d |
.SH OPTIONS
|
|
Packit |
57988d |
.IP "\fB--detail\fR level"
|
|
Packit |
57988d |
This is the detail level of the report.
|
|
Packit |
57988d |
.I level
|
|
Packit |
57988d |
can be a positive integer, or high, med, low, which correspond to the
|
|
Packit |
57988d |
integers 10, 5, and 0, respectively.
|
|
Packit |
57988d |
.IP "\fB--logfile\fR log-file-group"
|
|
Packit |
57988d |
This will force Logwatch to process only the set of logfiles
|
|
Packit |
57988d |
defined by
|
|
Packit |
57988d |
.I log-file-group
|
|
Packit |
57988d |
(i.e. messages, xferlog, ...). Logwatch will therefore process
|
|
Packit |
57988d |
all services that use those logfiles. This option can be specified
|
|
Packit |
57988d |
more than once to specify multiple logfile-groups.
|
|
Packit |
57988d |
.IP "\fB--service\fR service-name"
|
|
Packit |
57988d |
This will force Logwatch to process only the service specified in
|
|
Packit |
57988d |
.I service-name
|
|
Packit |
57988d |
(i.e. login, pam, identd, ...). Logwatch will therefore also process
|
|
Packit |
57988d |
any log-file-groups necessary to process these services. This option
|
|
Packit |
57988d |
can be specified more than once to specify multiple services to process.
|
|
Packit |
57988d |
A useful
|
|
Packit |
57988d |
.I service-name
|
|
Packit |
57988d |
is
|
|
Packit |
57988d |
.I All
|
|
Packit |
57988d |
which will process all services (and logfile-groups) for which you have
|
|
Packit |
57988d |
filters installed.
|
|
Packit |
57988d |
.IP "\fB--mailto\fR address"
|
|
Packit |
57988d |
Mail the results to the email address or user specified in
|
|
Packit |
57988d |
.I address.
|
|
Packit |
57988d |
.IP "\fB--range\fR range"
|
|
Packit |
57988d |
You can specify a date-range to process. Common ranges are
|
|
Packit |
57988d |
.I Yesterday, Today, All,
|
|
Packit |
57988d |
and
|
|
Packit |
57988d |
.I Help.
|
|
Packit |
57988d |
Additional options are listed when invoked with the
|
|
Packit |
57988d |
.I Help
|
|
Packit |
57988d |
parameter.
|
|
Packit |
57988d |
.IP "\fB--archives\fR"
|
|
Packit |
57988d |
Each log-file-group has basic logfiles (i.e. /var/log/messages) as
|
|
Packit |
57988d |
well as archives (i.e. /var/log/messages.? or /var/log/messages.?.gz).
|
|
Packit |
57988d |
When used with "\-\-range all", this option will make Logwatch search
|
|
Packit |
57988d |
through the archives in addition to the regular logfiles. For other
|
|
Packit |
57988d |
values of \-\-range, Logwatch will search the appropriate archived logs.
|
|
Packit |
57988d |
.IP "\fB--debug\fR level"
|
|
Packit |
57988d |
For debugging purposes.
|
|
Packit |
57988d |
.I level
|
|
Packit |
57988d |
can range from 0 to 100. This will
|
|
Packit |
57988d |
.I really
|
|
Packit |
57988d |
clutter up your output. You probably don't want to use this.
|
|
Packit |
57988d |
.IP "\fB--filename\fR file-name"
|
|
Packit |
57988d |
Save the output to
|
|
Packit |
57988d |
.I file-name
|
|
Packit |
57988d |
instead of displaying or mailing it.
|
|
Packit |
57988d |
.IP "\fB--logdir\fR directory"
|
|
Packit |
57988d |
Look in
|
|
Packit |
57988d |
.I directory
|
|
Packit |
57988d |
for log subdirectories or log files first before looking in the default directories.
|
|
Packit |
57988d |
.IP "\fB--hostlimit\fR host1,host2"
|
|
Packit |
57988d |
Limit report to hostname - host1, host2.
|
|
Packit |
57988d |
.IP "\fB--hostname\fR hostname"
|
|
Packit |
57988d |
Use
|
|
Packit |
57988d |
.I hostname
|
|
Packit |
57988d |
for the reports instead of this system's hostname. In addition,
|
|
Packit |
57988d |
if HostLimit is set in the logwatch.conf configuration file (see
|
|
Packit |
57988d |
\fBMORE INFORMATION\fR, below),
|
|
Packit |
57988d |
then only logs from this hostname will be processed (where appropriate).
|
|
Packit |
57988d |
.IP "\fB--html_wrap\fR num-characters"
|
|
Packit |
57988d |
Number of characters that html output should be wrapped to. Default is 80.
|
|
Packit |
57988d |
.IP "\fB--numeric\fR"
|
|
Packit |
57988d |
Inhibits additional name lookups, displaying IP addresses numerically.
|
|
Packit Service |
d574e7 |
.IP "\fB--no-oldfiles-log\fR"
|
|
Packit Service |
d574e7 |
Suppress the logwatch log, which informs about the
|
|
Packit Service |
d574e7 |
old files in logwatch tmpdir.
|
|
Packit |
57988d |
.IP "\fB--usage\fR"
|
|
Packit |
57988d |
Displays usage information
|
|
Packit |
57988d |
.IP "\fB--help\fR"
|
|
Packit |
57988d |
same as \-\-usage.
|
|
Packit |
57988d |
.SH FILES
|
|
Packit |
57988d |
.IP /usr/share/logwatch/
|
|
Packit |
57988d |
.RS
|
|
Packit |
57988d |
This directory contains all the perl executables and
|
|
Packit |
57988d |
configuration files shipped with the logwatch distribution.
|
|
Packit |
57988d |
.RE
|
|
Packit |
57988d |
.IP /etc/logwatch
|
|
Packit |
57988d |
.RS
|
|
Packit |
57988d |
This directory contains local configuration files that override
|
|
Packit |
57988d |
the default configuration. See \fBMORE INFORMATION\fR below for more
|
|
Packit |
57988d |
information.
|
|
Packit |
57988d |
.RE
|
|
Packit |
57988d |
.SH EXAMPLES
|
|
Packit |
57988d |
.B logwatch --service ftpd-xferlog --range all --detail high --archives
|
|
Packit |
57988d |
.RS
|
|
Packit |
57988d |
This will print out all FTP transfers that are stored in all current and archived
|
|
Packit |
57988d |
xferlogs.
|
|
Packit |
57988d |
.RE
|
|
Packit |
57988d |
.B logwatch --service pam_pwdb --range yesterday --detail high
|
|
Packit |
57988d |
.RS
|
|
Packit |
57988d |
This will print out login information for the previous day...
|
|
Packit |
57988d |
.RE
|
|
Packit |
57988d |
.SH MORE INFORMATION
|
|
Packit |
57988d |
The directory /usr/share/doc/logwatch-* contains several files with additional
|
|
Packit |
57988d |
documentation:
|
|
Packit |
57988d |
.RE
|
|
Packit |
57988d |
.I HOWTO-Customize-LogWatch
|
|
Packit |
57988d |
.RS
|
|
Packit |
57988d |
Documents the directory structure of Logwatch configuration and executable
|
|
Packit |
57988d |
files, and describes how to customize Logwatch by overriding these default
|
|
Packit |
57988d |
files.
|
|
Packit |
57988d |
.RE
|
|
Packit |
57988d |
.I LICENSE
|
|
Packit |
57988d |
.RS
|
|
Packit |
57988d |
Describes the License under which Logwatch is distributed. Additional
|
|
Packit |
57988d |
clauses may be specified in individual files.
|
|
Packit |
57988d |
.RE
|
|
Packit |
57988d |
.I README
|
|
Packit |
57988d |
.RS
|
|
Packit |
57988d |
Describes how to install, where to find it, mailing lists, and
|
|
Packit |
57988d |
other useful information.
|
|
Packit |
57988d |
.SH AUTHOR
|
|
Packit |
57988d |
.RE
|
|
Packit |
57988d |
Kirk Bauer <kirk@kaybee.org>
|
|
Packit |
57988d |
.RE
|
|
Packit |
57988d |
http://www.kaybee.org/~kirk
|
|
Packit |
57988d |
.RE
|
|
Packit |
57988d |
http://logwatch.sourceforge.net
|