logwatch filters are incomplete and too noisy

Asked by Tom Metro

I think logwatch is one of the best ways of keeping an eye on the system logs, and believe that it is worthy of being included in the base install of Ubuntu. (It seems poor design to have an OS where the GUI hides critical errors from the user. If not logwatch, then some other solution ought to be bundled with the OS.)

But disappointingly there are two big problems with logwatch as packaged for Ununtu:

1. The supplied filters are not synchronized to the version of the daemons in that same Ubuntu version. For example, I setup a new 12.04 system, installed logwatch, and I get plenty of unmatched entries:

 **Unmatched Entries**
    dbus: [system] Rejected send message, 2 matched rules; type="error", sender=":1.59" (uid=0 pid=2055 comm="/usr/lib/udisks/udisks-daemon ") interface="(unset)" member="(unset)" error name="org.freedesktop.DBus.Error.UnknownMethod" requested_reply="0" destination=":1.303" (uid=1000 pid=8471 comm="k3b "): 1 Time(s)
    gnome-screensaver-dialog: gkr-pam: unlocked login keyring: 2 Time(s)

 **Unmatched Entries**
 Device: /dev/sdb [SAT], offline data collection was suspended by an interrupting command from host (auto:on)
 Device: /dev/sdb [SAT], offline data collection was completed without error (auto:on)

OK, I get smartd problems, as that's an optional package, and it would appear logwatch is not widely used on Ubuntu, so not enough resources to deal with every possible optional package, but what about core components, like dbus and gnome-screensaver that are core components? (The dbus message perhaps appears as an unmatched entry as designed, as it appears to be an actual error. But the gnome-screensaver looks like something that should be recognized. I'll file bugs for the gnome-screensaver and smartd unmatched entries.)

2. It's too noisy. You can tweak a lot in logwatch, but to meet the goal of having logwatch be a standard component of Ubuntu, it needs to be silent unless there are actual errors. For example, I installed postfix, and now I get a near useess information report in each logwatch email:

 --------------------- Postfix Begin ------------------------

    3.849K Bytes accepted 3,941
    3.975K Bytes sent via SMTP 4,070
    3.849K Bytes delivered 3,941
    3.849K Bytes forwarded 3,941
 ======== ==================================================

        1 Accepted 100.00%
 -------- --------------------------------------------------
        1 Total 100.00%
 ======== ==================================================

        2 Removed from queue
        1 Delivered
        1 Sent via SMTP
        1 Forwarded

 ---------------------- Postfix End -------------------------

(Postfix is pretty much used only to deliver the daily logwatch email to my mail server.)

Logwatch needs to ship configured to report only errors, and as I recall some filters don't fully respect those global settings and will require modification.

If logwatch was ideally tuned, I would never see emails from it unless there was an actual error. Instead what happens is that I get daily emails that are mostly useless noise, which leads to me ignoring them, and then I never see the real errors.

My question that all this leads to is: are the above items aligned with the goals you have in mind for the logwatch Ubuntu package?

Question information

Language:
English Edit question
Status:
Answered
For:
Ubuntu logwatch Edit question
Assignee:
No assignee Edit question
Last query:
Last reply:
Revision history for this message
actionparsnip (andrew-woodhead666) said :
#1

I suggest you report a bug

Revision history for this message
Greg Bell (gbell-spamless) said :
#2

This is a top Google result when searching for "logwatch noisy", so if there is a bug for it (I couldn't find one), it would be good to post it here.

It's a bit too general of a complaint/question. The question really should be something like: Can the package maintainers please update the logwatch filters so dbus errors:

dbus: [system] Rejected send message, 2 matched rules; type="method_call", sender=":1.3533" (uid=112 pid=11568 comm="/usr/lib/i386-linux-gnu/indicator-bluetooth/indica") interface="org.bluez.Manager" member="DefaultAdapter" error name="(unset)" requested_reply="0" destination="org.bluez" (uid=0 pid=522 comm="/usr/sbin/bluetoothd "): 1 Time(s)

Don't clutter up the daily report.

Can you help with this problem?

Provide an answer of your own, or ask Tom Metro for more information if necessary.

To post a message you must log in.