I am trying to get a logwatch summary emailed to a central address from a cron job. The tasd was copied verbatim from a system which does this already. Both are shown below. host1 crontab -l as root 45 7 * * * /usr/sbin/logwatch --service http --service imapd --service pop3 --service sshd --service vsftpd --service zz-disk_space --service zz-network --service zz-sys --mailto support at harte-lyne.ca host2 crontab -l as root 45 7 * * * /usr/sbin/logwatch --service http --service imapd --service pop3 --service sshd --service vsftpd --service zz-disk_space -- service zz-network --service zz-sys --mailto support at harte-lyne.ca #Logwatch summary My problem is that only the first gets delivered to support at harte-lyne.ca. The second gets delivered to root at host2.harte-lyne.ca and not to support. It has been a considerable time since I dealt with logwatch on the first machine and I cannot remember is there was any special configuration of logwatch itself to enable this to happen. Does anyone know what I might be overlooking? The curious thing is that if I cut and paste the host2 cron job entry into a terminal window that is logged in as root on host2 then the logwatch report goes to support as I intend. -- *** E-Mail is NOT a SECURE channel *** James B. Byrne mailto:ByrneJB at Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3
James B. Byrne wrote:> host1 crontab -l as root > > 45 7 * * * /usr/sbin/logwatch --service http --service imapd > --service pop3 --service sshd --service vsftpd --service > zz-disk_space --service zz-network --service zz-sys --mailto > support at harte-lyne.ca > > host2 crontab -l as root > > 45 7 * * * /usr/sbin/logwatch --service http --service imapd > --service pop3 --service sshd --service vsftpd --service > zz-disk_space -- service zz-network --service zz-sys --mailto > support at harte-lyne.ca #Logwatch summary >Hello, I'm afraid I cannot address your specific question, however this may still be helpful... I recommend moving all of those command line switches from your crontab into the config file(s). The defaults are defined in /usr/share/logwatch/default.conf/logwatch.conf The logwatch maintainers intend users to override those defaults in /etc/logwatch/conf/logwatch.conf If you move your customizations to /etc/logwatch/conf/logwatch.conf, then you can call logwatch without any switches at all. Also, something I do and find useful is to leave delivery of the logwatch emails set to the default - root at localhost. Then forward root's mail to my external system at domain account. This way I get any/all system generated e-mail to root (like an mdadm failed array event!), not just logwatch. Hope that helps, Andy Hull
lists-centos wrote:> Do you really have the comment on the line with the command in the > second one? That's not allowed, and will mess things up, see the > crontab(5) man page - second paragraph under "description". > > If you have that comment there it's hard to tell exactly what will > happen in terms of addressing. > > - Rick >Regardless of what the man page says in practice bash treats everything after a # as a comment. Most of my crontab entries on various hosts have comments appended and they all work, for example this one from host3: 45 7 * * * /usr/sbin/logwatch --service http --service imapd --service pop3 --service sshd --service vsftpd --service zz-disk_space --mailto support at harte-lyne.ca #Daily Logwatch report on server access services. In any case, removing the comment from the crontab entry on the host in question does not change the behaviour. The logwatch report is still mailed to root at host2.harte-lyne.ca Sincerely,
On Fri, October 23, 2009 14:22, James B. Byrne wrote:> > I am trying to get a logwatch summary emailed to a central address > from a cron job. The tasd was copied verbatim from a system which > does this already. Both are shown below. > > > host1 crontab -l as root > > 45 7 * * * /usr/sbin/logwatch --service http --service imapd > --service pop3 --service sshd --service vsftpd --service > zz-disk_space --service zz-network --service zz-sys --mailto > support at harte-lyne.ca > > host2 crontab -l as root > > 45 7 * * * /usr/sbin/logwatch --service http --service imapd > --service pop3 --service sshd --service vsftpd --service > zz-disk_space -- service zz-network --service zz-sys --mailto > support at harte-lyne.ca #Logwatch summary > > > My problem is that only the first gets delivered to > support at harte-lyne.ca. The second gets delivered to > root at host2.harte-lyne.ca and not to support. It has been a > considerable time since I dealt with logwatch on the first machine > and I cannot remember is there was any special configuration of > logwatch itself to enable this to happen. Does anyone know what I > might be overlooking?I thought after the pain I went through finding the solution for this that some here might be amused to learn what the problem turned out to be. Note this portion of the second, misbehaving, cron entry example:> zz-disk_space -- service zz-network --service zz-sys --mailtoThere is an errant space between -- and service for the --service flag to the zz-network argument; and this caused all the difficulty. -- *** E-Mail is NOT a SECURE channel *** James B. Byrne mailto:ByrneJB at Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3