Monitor System Logs via E-mail

This will provide the capability to receive system logs via e-mail. There are many customizable features (Logwatch Documentation), but this will only identify the basic ones.

• First, open a terminal window and become root. Enter the following to install:

bash code
​yum install logwatch​

• You can customize the settings by adding options to /usr/share/logwatch/default.conf/logwatch.conf however local configuration options can be done at /etc/logwatch/conf/logwatch.conf. By default it sends the daily logwatch email to the local root mail box. To change it, add this line (change user@yourisp.com to desired email address):

Text
​MailTo = user@yourisp.com​

• If you want the email in html, add this line:

Text
​Output = html​

• To test, enter the command logwatch and go check your email.

bash code
​logwatch​

• Ensure sendmail or postfix is running (rerun command and change status to start if not):

bash code
​service sendmail status​

or

bash code
​service postfix status​

Optional:

• These are a few more basic options that can be configured.
  • Range = yesterday (default) - additional values are all or today.
  • Detail = Low (default) - additional values are med or high. I set mine to med.

This application runs transparent in the background, once daily in the morning. If you want to run it more frequently (i.e. send logs for today), then change the range and execute the command logwatch as needed.

NOTE: If you want to forward these emails to another (including external) account, see Forward System Emails.