logwatch filters are incomplete and too noisy
I think logwatch is one of the best ways of keeping an eye on the system logs, and believe that it is worthy of being included in the base install of Ubuntu. (It seems poor design to have an OS where the GUI hides critical errors from the user. If not logwatch, then some other solution ought to be bundled with the OS.)
But disappointingly there are two big problems with logwatch as packaged for Ununtu:
1. The supplied filters are not synchronized to the version of the daemons in that same Ubuntu version. For example, I setup a new 12.04 system, installed logwatch, and I get plenty of unmatched entries:
**Unmatched Entries**
dbus: [system] Rejected send message, 2 matched rules; type="error", sender=":1.59" (uid=0 pid=2055 comm="/
gnome-
**Unmatched Entries**
Device: /dev/sdb [SAT], offline data collection was suspended by an interrupting command from host (auto:on)
Device: /dev/sdb [SAT], offline data collection was completed without error (auto:on)
OK, I get smartd problems, as that's an optional package, and it would appear logwatch is not widely used on Ubuntu, so not enough resources to deal with every possible optional package, but what about core components, like dbus and gnome-screensaver that are core components? (The dbus message perhaps appears as an unmatched entry as designed, as it appears to be an actual error. But the gnome-screensaver looks like something that should be recognized. I'll file bugs for the gnome-screensaver and smartd unmatched entries.)
2. It's too noisy. You can tweak a lot in logwatch, but to meet the goal of having logwatch be a standard component of Ubuntu, it needs to be silent unless there are actual errors. For example, I installed postfix, and now I get a near useess information report in each logwatch email:
------
3.849K Bytes accepted 3,941
3.975K Bytes sent via SMTP 4,070
3.849K Bytes delivered 3,941
3.849K Bytes forwarded 3,941
======== =======
1 Accepted 100.00%
-------- -------
1 Total 100.00%
======== =======
2 Removed from queue
1 Delivered
1 Sent via SMTP
1 Forwarded
------
(Postfix is pretty much used only to deliver the daily logwatch email to my mail server.)
Logwatch needs to ship configured to report only errors, and as I recall some filters don't fully respect those global settings and will require modification.
If logwatch was ideally tuned, I would never see emails from it unless there was an actual error. Instead what happens is that I get daily emails that are mostly useless noise, which leads to me ignoring them, and then I never see the real errors.
My question that all this leads to is: are the above items aligned with the goals you have in mind for the logwatch Ubuntu package?
Question information
- Language:
- English Edit question
- Status:
- Answered
- For:
- Ubuntu logwatch Edit question
- Assignee:
- No assignee Edit question
- Last query:
- Last reply:
Can you help with this problem?
Provide an answer of your own, or ask Tom Metro for more information if necessary.