Logwatch failed to complete successfully

dancingpony

Member
Mar 29, 2016
10
1
3
Brisbane, Australia
cPanel Access Level
Root Administrator
I've found this thread that explains my issue, and shows how to 'fix' it:
Logwatch Issue?

However, one of the cPanel members suggested that if the logwatch directories are consecutive and recent, then the issue should be looked into further.

This is the case for my directories - it is happening everyday at the same time.

I can open the logwatch.XXXXXX directories and see a list of log files, however I'm not sure where or what I should be looking for. Will one of these log files end with an obvious error?

All log files are date and timed the same (is there a way to see the time with seconds, so I can tell with log file was created last?).

I know I can just remove all the directories, but that obviously won't solved the problem in my case.
 

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,909
2,228
463
Hello @dancingpony,

Could you paste the output from your logwatch cron job and logwatch configuration file? You can do so with commands such as:

Code:
cat /etc/cron.daily/0logwatch
cat /etc/logwatch/conf/logwatch.conf
Also, try running the "/usr/sbin/logwatch" and "stat /var/cache/logwatch" commands to review the permission/ownership values on "/var/cache/logwatch" and to check for any specific error output when running the logwatch command manually.

Additionally, use the "df -h" and "df -i" commands to make sure your /var partition isn't at it's disk space or inode limit.

Thank you.
 

dancingpony

Member
Mar 29, 2016
10
1
3
Brisbane, Australia
cPanel Access Level
Root Administrator
Hi @cPanelMichael

The output of the 'cron.daily' command has almost 1400 lines - do you need all of it?

The output of the 'conf' file is as below:
Code:
# Local configuration options go here (defaults are in /usr/share/logwatch/default.conf/logwatch.conf)
I don't think there is an issue with the disk/inode limit.

I ran the 'stat' command but to be honest didn't really know what I was looking for. If I run the '/usr/sbin/logwatch' command will it output errors to the terminal, or does it create a log file?

Is there a error/log file that I can view that would outline what the error is?
 

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,909
2,228
463
The output of the 'cron.daily' command has almost 1400 lines - do you need all of it?
This might be where the issue stems from. Here's the default version of this file:

Code:
#!/bin/sh

#Set logwatch location
LOGWATCH_SCRIPT="/usr/sbin/logwatch"
#Add options to this line. Most options should be defined in /etc/logwatch/conf/logwatch.conf,
#but some are only for the nightly cronrun such as --output mail and should be set here.
#Other options to consider might be "--format html" or "--encode base64", man logwatch for more details.
OPTIONS="--output mail"

#Call logwatch
$LOGWATCH_SCRIPT $OPTIONS

exit 0
As you can see, it's much less than 1400 lines. You may want to uninstall and then reinstall the logwatch package on your system to revert it to the default settings:

Code:
yum remove logwatch
yum install logwatch
Thank you.
 

dancingpony

Member
Mar 29, 2016
10
1
3
Brisbane, Australia
cPanel Access Level
Root Administrator
Our version starts with the code below:

Code:
#!/usr/bin/perl -w
use strict;
##########################################################################
# $Id: logwatch.pl,v 1.171 2006/03/24 23:16:55 kirk Exp $
##########################################################################
# Most current version can always be found at:
# ftp://ftp.logwatch.org/pub/redhat/RPMS

########################################################
# Specify version and build-date:
my $Version = '7.3';
my $VDate = '03/24/06';

#######################################################
# This was written and is maintained by:
#    Kirk Bauer <[email protected]>
#
# Please send all comments, suggestions, bug reports,
#    etc, to [email protected]
#
########################################################
So perhaps ours is just super old?

I'll chat to our System Administrators and find out my options.
 

dancingpony

Member
Mar 29, 2016
10
1
3
Brisbane, Australia
cPanel Access Level
Root Administrator
We've recently migrated from CentOS 5 to CentOS 7 - and the since that time I haven't received anymore of these messages - plus the /var/cache/logwatch is non-existent - so I'm assuming there hasn't been an issue.

I imagine this is due to the cron.daily file being updated.
 
  • Like
Reactions: cPanelMichael