[PLUG] logwatch.conf

[Reid]

Hi, Rich. Have you tried setting Service to an empty string yet in /etc/logwatch/conf/logwatch.conf as mentioned in the last email? That works for me as a method of overriding the "Service = All" line in /usr/share/logwatch/default.conf/logwatch.conf.

# grep -v ^# /etc/logwatch/conf/logwatch.conf
Service = cron
# logwatch
Wrong configuration entry for "Service", if "All" selected, only "-" items are allowed

# grep -v ^# /etc/logwatch/conf/logwatch.conf
Service =
Service = cron
# logwatch
#


Sent with ProtonMail Secure Email.

‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐
On Thursday, October 24, 2019 10:25 AM, Rich Shepard <rshepard at appl-ecosys.com> wrote:

> On Wed, 23 Oct 2019, Reid wrote:
>
> > Try running `/usr/sbin/logwatch --debug High` to see the full service list
> > and each config file line that's being read in.
>
> Reid, et al.
>
> Here's /etc/logwatch/conf/logwatch.conf (comments removed):
>
> Default Log Directory
>
> ======================
>
> All log-files are assumed to be given relative to this directory.
>
> ==================================================================
>
> LogDir = /var/log
>
> You can override the default temp directory (/tmp) here
>
> ========================================================
>
> TmpDir = /var/cache/logwatch
>
> #To make Html the default formatting Format = html
> Format = text
> #To make Base64 [aka uuencode] Encode = base64
> Encode = none
>
> Default person to mail reports to. Can be a local account or a
>
> ===============================================================
>
> complete email address. Variable Output should be set to mail, or
>
> ==================================================================
>
> --output mail should be passed on command line to enable mail feature.
>
> =======================================================================
>
> MailTo = root
>
> Default person to mail reports from. Can be a local account or a
>
> =================================================================
>
> complete email address.
>
> ========================
>
> MailFrom = Logwatch
>
> Archives = No
>
> Range = yesterday
>
> Detail = Low
>
> The 'Service' option expects either the name of a filter (in
>
> =============================================================
>
> /usr/share/logwatch/scripts/services/*) or 'All'. The default service(s)
>
> =========================================================================
>
> to report on. This should be left as All for most people.
>
> ==========================================================
>
> Service = cron
> Service = kernel
> Service = postfix
> Service = sshd
> Service = syslogd
> Service = xntpd
> Service = zz-disk_space
> Service = zz-fortune
> Service = zz-lm_sensors
>
> You can also disable certain services (when specifying all)
>
> ============================================================
>
> Service = "-zz-network" # Prevents execution of zz-network service, which
> # prints useful network configuration info.
> Service = "-zz-sys" # Prevents execution of zz-sys service, which
> # prints useful system configuration info.
> Service = "-eximstats" # Prevents execution of eximstats service, which
> # is a wrapper for the eximstats program.
>
> mailer = "/usr/sbin/sendmail -t"
>
> EOF
>
> ====
>
> Notice that there is no 'All' or 'all' for services. But, when I run
> logwatch,
>
> /usr/sbin/logwatch
>
> ===================
>
> Wrong configuration entry for "Service", if "All" selected, only "-" items are allowed
>
> No matter how many times I look (eyeballs and grep) the only references to
> All or all are in comments.
>
> Regards,
>
> Rich
>
> PLUG mailing list
> PLUG at pdxlinux.org
> http://lists.pdxlinux.org/mailman/listinfo/plug