The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Logwatch failed to complete successfully

Discussion in 'General Discussion' started by dancingpony, Dec 14, 2016.

Tags:
  1. dancingpony

    dancingpony Member

    Joined:
    Mar 29, 2016
    Messages:
    10
    Likes Received:
    1
    Trophy Points:
    3
    Location:
    Brisbane, Australia
    cPanel Access Level:
    Root Administrator
    I've found this thread that explains my issue, and shows how to 'fix' it:
    Logwatch Issue?

    However, one of the cPanel members suggested that if the logwatch directories are consecutive and recent, then the issue should be looked into further.

    This is the case for my directories - it is happening everyday at the same time.

    I can open the logwatch.XXXXXX directories and see a list of log files, however I'm not sure where or what I should be looking for. Will one of these log files end with an obvious error?

    All log files are date and timed the same (is there a way to see the time with seconds, so I can tell with log file was created last?).

    I know I can just remove all the directories, but that obviously won't solved the problem in my case.
     
  2. Eric

    Eric Administrator
    Staff Member

    Joined:
    Nov 25, 2007
    Messages:
    752
    Likes Received:
    11
    Trophy Points:
    143
    Location:
    Texas
    cPanel Access Level:
    Root Administrator
    Howdy,

    Normally logwatch is an email to the root users /root/.forward email address. Are you getting the emails or an error when the cronjobs?

    Thanks!
     
  3. dancingpony

    dancingpony Member

    Joined:
    Mar 29, 2016
    Messages:
    10
    Likes Received:
    1
    Trophy Points:
    3
    Location:
    Brisbane, Australia
    cPanel Access Level:
    Root Administrator
    I'm getting the emails.

    I'm assuming they are sent when cron.daily runs and it sees that I have those 'old files in your logwatch tmpdir'
     
  4. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    37,173
    Likes Received:
    1,295
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    Hello @dancingpony,

    Could you paste the output from your logwatch cron job and logwatch configuration file? You can do so with commands such as:

    Code:
    cat /etc/cron.daily/0logwatch
    cat /etc/logwatch/conf/logwatch.conf
    
    Also, try running the "/usr/sbin/logwatch" and "stat /var/cache/logwatch" commands to review the permission/ownership values on "/var/cache/logwatch" and to check for any specific error output when running the logwatch command manually.

    Additionally, use the "df -h" and "df -i" commands to make sure your /var partition isn't at it's disk space or inode limit.

    Thank you.
     
  5. dancingpony

    dancingpony Member

    Joined:
    Mar 29, 2016
    Messages:
    10
    Likes Received:
    1
    Trophy Points:
    3
    Location:
    Brisbane, Australia
    cPanel Access Level:
    Root Administrator
    Hi @cPanelMichael

    The output of the 'cron.daily' command has almost 1400 lines - do you need all of it?

    The output of the 'conf' file is as below:
    Code:
    # Local configuration options go here (defaults are in /usr/share/logwatch/default.conf/logwatch.conf)
    I don't think there is an issue with the disk/inode limit.

    I ran the 'stat' command but to be honest didn't really know what I was looking for. If I run the '/usr/sbin/logwatch' command will it output errors to the terminal, or does it create a log file?

    Is there a error/log file that I can view that would outline what the error is?
     
  6. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    37,173
    Likes Received:
    1,295
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    This might be where the issue stems from. Here's the default version of this file:

    Code:
    #!/bin/sh
    
    #Set logwatch location
    LOGWATCH_SCRIPT="/usr/sbin/logwatch"
    #Add options to this line. Most options should be defined in /etc/logwatch/conf/logwatch.conf,
    #but some are only for the nightly cronrun such as --output mail and should be set here.
    #Other options to consider might be "--format html" or "--encode base64", man logwatch for more details.
    OPTIONS="--output mail"
    
    #Call logwatch
    $LOGWATCH_SCRIPT $OPTIONS
    
    exit 0
    As you can see, it's much less than 1400 lines. You may want to uninstall and then reinstall the logwatch package on your system to revert it to the default settings:

    Code:
    yum remove logwatch
    yum install logwatch
    Thank you.
     
  7. dancingpony

    dancingpony Member

    Joined:
    Mar 29, 2016
    Messages:
    10
    Likes Received:
    1
    Trophy Points:
    3
    Location:
    Brisbane, Australia
    cPanel Access Level:
    Root Administrator
    Our version starts with the code below:

    Code:
    #!/usr/bin/perl -w
    use strict;
    ##########################################################################
    # $Id: logwatch.pl,v 1.171 2006/03/24 23:16:55 kirk Exp $
    ##########################################################################
    # Most current version can always be found at:
    # ftp://ftp.logwatch.org/pub/redhat/RPMS
    
    ########################################################
    # Specify version and build-date:
    my $Version = '7.3';
    my $VDate = '03/24/06';
    
    #######################################################
    # This was written and is maintained by:
    #    Kirk Bauer <kirk@kaybee.org>
    #
    # Please send all comments, suggestions, bug reports,
    #    etc, to logwatch@logwatch.org.
    #
    ########################################################
    So perhaps ours is just super old?

    I'll chat to our System Administrators and find out my options.
     
  8. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    37,173
    Likes Received:
    1,295
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    Hello,

    Let us know how it goes.

    Thank you.
     
  9. dancingpony

    dancingpony Member

    Joined:
    Mar 29, 2016
    Messages:
    10
    Likes Received:
    1
    Trophy Points:
    3
    Location:
    Brisbane, Australia
    cPanel Access Level:
    Root Administrator
    We've recently migrated from CentOS 5 to CentOS 7 - and the since that time I haven't received anymore of these messages - plus the /var/cache/logwatch is non-existent - so I'm assuming there hasn't been an issue.

    I imagine this is due to the cron.daily file being updated.
     
    cPanelMichael likes this.
Loading...

Share This Page