Logwatch failed to complete successfully

[dancingpony]

I've found this thread that explains my issue, and shows how to 'fix' it:
Logwatch Issue?

However, one of the cPanel members suggested that if the logwatch directories are consecutive and recent, then the issue should be looked into further.

This is the case for my directories - it is happening everyday at the same time.

I can open the logwatch.XXXXXX directories and see a list of log files, however I'm not sure where or what I should be looking for. Will one of these log files end with an obvious error?

All log files are date and timed the same (is there a way to see the time with seconds, so I can tell with log file was created last?).

I know I can just remove all the directories, but that obviously won't solved the problem in my case.

 

[Eric]

Howdy,

Normally logwatch is an email to the root users /root/.forward email address. Are you getting the emails or an error when the cronjobs?

Thanks!

 

[dancingpony]

I'm getting the emails.

I'm assuming they are sent when cron.daily runs and it sees that I have those 'old files in your logwatch tmpdir'

 

[cPanelMichael]

Hello @dancingpony,

Could you paste the output from your logwatch cron job and logwatch configuration file? You can do so with commands such as:

cat /etc/cron.daily/0logwatch
cat /etc/logwatch/conf/logwatch.conf

Also, try running the "/usr/sbin/logwatch" and "stat /var/cache/logwatch" commands to review the permission/ownership values on "/var/cache/logwatch" and to check for any specific error output when running the logwatch command manually.

Additionally, use the "df -h" and "df -i" commands to make sure your /var partition isn't at it's disk space or inode limit.

Thank you.

 

[dancingpony]

Hi @cPanelMichael

The output of the 'cron.daily' command has almost 1400 lines - do you need all of it?

The output of the 'conf' file is as below:

# Local configuration options go here (defaults are in /usr/share/logwatch/default.conf/logwatch.conf)

I don't think there is an issue with the disk/inode limit.

I ran the 'stat' command but to be honest didn't really know what I was looking for. If I run the '/usr/sbin/logwatch' command will it output errors to the terminal, or does it create a log file?

Is there a error/log file that I can view that would outline what the error is?

 

[cPanelMichael]

The output of the 'cron.daily' command has almost 1400 lines - do you need all of it?

This might be where the issue stems from. Here's the default version of this file:

#!/bin/sh

#Set logwatch location
LOGWATCH_SCRIPT="/usr/sbin/logwatch"
#Add options to this line. Most options should be defined in /etc/logwatch/conf/logwatch.conf,
#but some are only for the nightly cronrun such as --output mail and should be set here.
#Other options to consider might be "--format html" or "--encode base64", man logwatch for more details.
OPTIONS="--output mail"

#Call logwatch
$LOGWATCH_SCRIPT $OPTIONS

exit 0

As you can see, it's much less than 1400 lines. You may want to uninstall and then reinstall the logwatch package on your system to revert it to the default settings:

yum remove logwatch
yum install logwatch

Thank you.

 

[dancingpony]

Our version starts with the code below:

#!/usr/bin/perl -w
use strict;
##########################################################################
# $Id: logwatch.pl,v 1.171 2006/03/24 23:16:55 kirk Exp $
##########################################################################
# Most current version can always be found at:
# ftp://ftp.logwatch.org/pub/redhat/RPMS

########################################################
# Specify version and build-date:
my $Version = '7.3';
my $VDate = '03/24/06';

#######################################################
# This was written and is maintained by:
#    Kirk Bauer <[email protected]>
#
# Please send all comments, suggestions, bug reports,
#    etc, to [email protected]
#
########################################################

So perhaps ours is just super old?

I'll chat to our System Administrators and find out my options.

 

[cPanelMichael]

I'll chat to our System Administrators and find out my options.

Hello,

Let us know how it goes.

Thank you.

 

[dancingpony]

We've recently migrated from CentOS 5 to CentOS 7 - and the since that time I haven't received anymore of these messages - plus the /var/cache/logwatch is non-existent - so I'm assuming there hasn't been an issue.

I imagine this is due to the cron.daily file being updated.