The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Upgraded Logwatch, now notices do not arrive.

Discussion in 'General Discussion' started by Metro2, Jun 3, 2007.

  1. Metro2

    Metro2 Well-Known Member

    Joined:
    May 24, 2006
    Messages:
    376
    Likes Received:
    10
    Trophy Points:
    18
    Location:
    USA
    cPanel Access Level:
    Root Administrator
    Hi all,

    A few days ago I upgraded to logwatch 7.3.6 and ever since then I am no longer receiving my daily logwatch notices in email. Is there a setting I could check/change to find or fix the problem?

    Thanks for any advice!
     
  2. sawbuck

    sawbuck Well-Known Member

    Joined:
    Jan 18, 2004
    Messages:
    1,367
    Likes Received:
    5
    Trophy Points:
    38
    cPanel Access Level:
    Root Administrator
    What do you show for this directive in logwatch.conf?

    # If set to 'Yes', the report will be sent to stdout instead of being mailed to above person.
    Print = Yes

    This was recently changed to be the default action.
     
  3. Metro2

    Metro2 Well-Known Member

    Joined:
    May 24, 2006
    Messages:
    376
    Likes Received:
    10
    Trophy Points:
    18
    Location:
    USA
    cPanel Access Level:
    Root Administrator
    Thank you sawbuck!
     
  4. wkdwich

    wkdwich Well-Known Member

    Joined:
    Apr 11, 2005
    Messages:
    105
    Likes Received:
    0
    Trophy Points:
    16
    I just realized I did not receive my logwatch this morning or yesterday..

    # Default person to mail reports to. Can be a local account or a
    # complete email address.
    MailTo = wkdwich@myconnection.com
    # Default person to mail reports from. Can be a local account or a
    # complete email address.
    MailFrom = Logwatch

    # If set to 'Yes', the report will be sent to stdout instead of being
    # mailed to above person.
    Print = No


    So why am I not getting the mails?? Any ideas??
     
  5. MaraBlue

    MaraBlue Well-Known Member

    Joined:
    May 3, 2005
    Messages:
    335
    Likes Received:
    2
    Trophy Points:
    18
    Location:
    Carmichael, CA
    cPanel Access Level:
    Root Administrator
    Have you check cron.daily to make sure the cron is there? Should look like this:
    Code:
    lrwxrwxrwx   1 root root    39 May 23 23:20 0logwatch -> /usr/share/logwatch/scripts/logwatch.pl*
    
     
  6. wkdwich

    wkdwich Well-Known Member

    Joined:
    Apr 11, 2005
    Messages:
    105
    Likes Received:
    0
    Trophy Points:
    16
    Thanks for the addiional response, but the report has sown up this morning.. now I need to alter what I get in there.. I want to see all FTP connections and files up/downloaded.. this bot that attcks and adds malicious conetnt is killing me

    Can you help with the conf to see the FTP connections??
     
  7. MaraBlue

    MaraBlue Well-Known Member

    Joined:
    May 3, 2005
    Messages:
    335
    Likes Received:
    2
    Trophy Points:
    18
    Location:
    Carmichael, CA
    cPanel Access Level:
    Root Administrator
    The .conf file has numerous options that can be changed/tweaked, like the higher the detail number the more that shows in the report.

    Thing is, Logwatch is just that....to watch the logs. From what you described,you need a firewall to *stop* this activity, not just see it happening up to 24 hours later. I'd recommend Chirpy's CSF, which can be found at configserver.com.
     
  8. wkdwich

    wkdwich Well-Known Member

    Joined:
    Apr 11, 2005
    Messages:
    105
    Likes Received:
    0
    Trophy Points:
    16
    been there done that.. the ips are in the iptable.. the attack last week was one that the IP was already in the iptables.. I checked.. so after that attack my host peeps said I need to use the ftphosts file and add ONLY my static IP so NO ONE else could FTP but me.. since I manage 90% of all the domains on the box this is a viable option..

    Do you have other suggestions?? Changing passwords does not help in this type of attack.. tried that and they got into the same domains again (4 times in 3 months now) I did extensive reading the other day on it.. one article I read said some 30k domains are effected DAILY from these attacks, that no one can figure out how they do it.. but in a 4 minute span they change index, login and a few other files in 15 domains before brute froce kicked in..
     
  9. MaraBlue

    MaraBlue Well-Known Member

    Joined:
    May 3, 2005
    Messages:
    335
    Likes Received:
    2
    Trophy Points:
    18
    Location:
    Carmichael, CA
    cPanel Access Level:
    Root Administrator
    Something's not set right then. Did you have Chirpy install CSF for you, or do it yourself? Have you checked the server for trojans, etc?

    Something's not right. If I were you, it would be worth it to have Chirpy lock down your system. I hate to sound like an advertisement for him, but he's thusfar the ONLY ONE I've used for security issues that I trust. He knows what he's doing and it typically takes less than an hour. Trust me, it's a small price to pay for peace of mind.
     
  10. wkdwich

    wkdwich Well-Known Member

    Joined:
    Apr 11, 2005
    Messages:
    105
    Likes Received:
    0
    Trophy Points:
    16
    Thanks Mara, I think I will do that that .. I was srriously contemplating signing up at platmu server management, several here have said they are good, but I have not done it yet..
     
  11. MaraBlue

    MaraBlue Well-Known Member

    Joined:
    May 3, 2005
    Messages:
    335
    Likes Received:
    2
    Trophy Points:
    18
    Location:
    Carmichael, CA
    cPanel Access Level:
    Root Administrator
    I can't recommend them as I've never used them, but I've also read a lot of praise for their work.

    For me, it's been important to find the line of where what server maintenance tasks are better to do myself, and when it makes more sense to sub-contract it out. Sometimes where that line is changes depending on my workload or my level of experience with what needs to be done. I've been known to spend days tinkering with an issue, just so I can learn what happened and why it did what it did, and how to stop that from happening in the future.

    Security issues are a different story. If it's beyond my abilities, I get someone in I trust, ASAP.

    Good luck to you.
     
  12. mohdyasar

    mohdyasar Active Member

    Joined:
    Jun 27, 2004
    Messages:
    43
    Likes Received:
    0
    Trophy Points:
    6
    Restart the server, simple, it will comeback and start sending mails, I had the sme issue and I restarted once and it worked.
     
  13. wkdwich

    wkdwich Well-Known Member

    Joined:
    Apr 11, 2005
    Messages:
    105
    Likes Received:
    0
    Trophy Points:
    16
    thanks yes they did start up again now.. I raised the level of report to 10 now, but I still want to see FTP login and transfers.. how to I make that happen.. do you know??
     
  14. mohdyasar

    mohdyasar Active Member

    Joined:
    Jun 27, 2004
    Messages:
    43
    Likes Received:
    0
    Trophy Points:
    6
    It will come now enable whatever you want to and it shall come automatically..
     
  15. wkdwich

    wkdwich Well-Known Member

    Joined:
    Apr 11, 2005
    Messages:
    105
    Likes Received:
    0
    Trophy Points:
    16
    no.. last night's report did not show me the FTP logins and transfers.. I REALLY want to see that
     
Loading...

Share This Page