Re: FC5 - Logwatch reports stopped [SOLVED]

Don Russell wrote:

Ed Kim wrote:

Don Russell wrote:

Ed Kim wrote:

Don Russell wrote:

Usually I receive a Logwatch report via e-mail everyday, timestamped at 0402 LOCAL TIME.

Today is the second day in a row I did not receive a report at all?

I tried running logwatch as root with --print but after a minute or so, there is nothing displayed and the command prompt is displayed again?

What would cause logwatch to stop reporting things? Where are the log files it uses to build the daily report?

The report showed things such as which updates were installed, current disk space, log in attempts (successful and failed)

It's not as if none of those things happened.

How does Logwatch get started each day? crontab -l doesn't show anything for root?

Thanks for any suggestions... :-)

logwatch monitors log files and services as defined in /etc/log.d/conf/... usually these log files reside in /var/log

the crontab -l is a user crontab, there's also a system crontab defined in /etc/crontab

could your /tmp be full?

There's lots of space on the drive.... can individual directories have limits? i.e. /tmp is "full", even though the drive is not? Even if that were the case, I'd expect some sort of errror message from logwatch when run via CLI. :-(

Filesystem           1K-blocks      Used Available Use% Mounted on
/dev/mapper/VolGroup00-LogVol00
                     37285432  10788896  24602548  31% /
/dev/hda1               101086     13862     82005  15% /boot
none                    517724         0    517724   0% /dev/shm

hmm... have you tried to run 'logwatch --debug 100'
hopefully, it'll pinpoint where it's failing..

Well.... a bunch more experimenting and here's what I've learned....

I *can* run logwatch manually and get the report for the two days missed.
But, if I specify the --mail option, I don't get the e-mail'd report.

If I use this command:
Mail -s "local test message" don@boris < /etc/fedora-release

I do not get an error,nor do I receive the test message. I tried several different e-mail addresses:

  - a single user id on the local machine
  - a userid@localhost
  - a fuly-qualified internet e-mail address

But, on another userid I have a perl script than runs periodically and sends an e-mail report to me at regular intervals.... *that* works fine.

So, I'm confident this means *logwatch* isworking ok... it's just the delivery of the report that's a problem.

But it used to work fine... as I mentioned, it's just the last two days that I did not receive it.