Logwatch
This is a perl script that scans logfiles and auto-generates reports. It sends them to you via email (plain txt or html).
Contents
Logfiles Watched
afpd denyhosts ftpd-xferlog netscreen pureftpd sendmail-largeboxes vsftpd amavis dhcpd http oidentd qmail shaperd windows arpwatch dnssec identd openvpn qmail-pop3d slon xntpd audit dovecot imapd pam qmail-pop3ds smartd yum automount dpkg init pam_pwdb qmail-send sonicwall zz-disk_space autorpm emerge in.qpopper pam_unix qmail-smtpd spamassassin zz-fortune barracuda evtapplication ipop3d php raid sshd zz-network bfd evtsecurity iptables pix resolver sshd2 zz-runtime cisco evtsystem kernel pluto rt314 stunnel zz-sys clamav exim mailscanner pop3 samba sudo clamav-milter eximstats modprobe portsentry saslauthd syslogd clam-update extreme-networks mountd postfix scsi tac_acc courier fail2ban named pound secure up2date cron ftpd-messages netopia proftpd-messages sendmail vpopmail
Install
First, you will need an smtp mailer. You might have a look at the sSmtp program
Ubuntu 10.04
sudo su apt-get install logwatch build-essential libyaml-perl perl -MCPAN -e 'install Sys::CPU' perl -MCPAN -e 'install Sys::MemInfo'
Configure
vim /usr/share/logwatch/default.conf/logwatch.conf
change:
Output = mail
Format = html
MailTo = root
Range = all
#Service = "-zz-network" # Prevents execution of zz-network service, which
# prints useful network configuration info.
#Service = "-zz-sys" # Prevents execution of zz-sys service, which
# prints useful system configuration info.
Service = "-eximstats" # Prevents execution of eximstats service, which
# is a wrapper for the eximstats program.
#Maybe Detail = High?
Example Output
Here's an example from a voip server
TBD
We need filters for FusionPBX logfiles, and FreeSWITCH logfiles.
Testing
logwatch --print > /tmp/logtest
Squeeze
If you choose html, header.html and footer.html are somehow missing.
mkdir /usr/share/logwatch/default.conf/html vim /usr/share/logwatch/default.conf/html/header.html
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
<html>
<head>
<title>Logwatch $Version ( $VDate )</title>
<meta name="generator" content="Logwatch $Version ( $VDate )">
<style type="text/css">
h1 {color: gray; border-bottom: 3px double silver}
h2,h3 {color: gray; border-bottom: 1px solid silver}
.ref {padding-left: 1%}
.service {padding-left: 1%; font-family: Monospace}
.return_link {border-top: 1px; border-bottom: 1px;
padding: 1%; margin-top: 1%; margin-bottom: 1%;}
.copyright {color: black; border-top: 1px solid grey;
border-bottom: 1px solid grey;
padding: 1%; margin-top: 1%; margin-bottom: 1%;}
</style>
</head>
<body style="width:90%; margin-left: 5%; margin-right: 5%" bgcolor="#FFFFFF">
<hr>
<!-- End header.html -->
vim /usr/share/logwatch/default.conf/html/footer.html
Logwatch ©Copyright 2002-2006 Kirk Bauer
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
</body></html>
<pre>
