Results 1 to 4 of 4

Thread: Ubuntu 20.04 LTS Logwatch Isse

  1. #1
    Join Date
    Nov 2013

    Ubuntu 20.04 LTS Logwatch Isse


    I have three Ubuntu web servers running logwtach. Two running 20.04 LTS and one running 18.04 LTS. Logwatch works correctly with version 18.04 LTS and Apache2 with good reporting on failed attempts, etc. However, 20.04 Logwatch reports omit the http section entirely as if it doesn't see the logs at all. The log files are there and have data, one of the 20.04 machines is busy so it should have a lot to talk about. I have the issue on both 20.04 servers. Is anyone else seeing the same behavior?



  2. #2
    Join Date
    Sep 2011
    Behind you!
    Ubuntu 18.04 Bionic Beaver

    Re: Ubuntu 20.04 LTS Logwatch Isse

    I have not found any recent logwatch tutorials and of the ones I have quickly glanced over, they were about as basic as basic gets. There might have been a format change in either Apache2 or how LogWatcher expects it. You might need to configure Apache to use a specific log option or modify logwatch to adjust how it looks at the data in the log file.

    But make sure you document what versions you are dealing with:

    apache2 -v
    logwatch -v
    Mine is:
    Apache 2.4.41
    Logwatch 7.5.2 (I just ran an "apt search logwatch" to see the version # in the repository)

    Related threads:
    No logwatch output for apache2 error.log

    Last edited by LHammonds; 3 Weeks Ago at 12:30 AM.

  3. #3
    Join Date
    Nov 2013

    Re: Ubuntu 20.04 LTS Logwatch Isse


    apache2 -v
    Server version: Apache/2.4.41 (Ubuntu)
    Server built: 2020-04-13T17:19:17
    logwatch -v
    Logwatch 7.5.2 (released 07/22/19)

    Logwatch is currently at 7.5.3 on sourceforge. I'm going to try updating, although I try to avoid having too many parts and pieces that are out of sync with the official repositories.

    I'll let you know how it goes.

    Thank you!

  4. #4
    Join Date
    Nov 2013

    Re: Ubuntu 20.04 LTS Logwatch Isse

    Upgrading did not resolve the issue. However, changing the output detail level did. So on my 18.04 LTS web server I'm running

    Logwatch 7.4.3 (released 12/07/16)

    It considers entries like this to be important enough to report with "Detail = Low":


    Requests with error response codes
    400 Bad Request
    null: 1 Time(s)
    403 Forbidden
    /: 2 Time(s)
    /manager/html: 1 Time(s)
    /manager/text/list: 1 Time(s)
    /portal/redlion: 1 Time(s)
    404 Not Found
    /favicon.ico: 5 Time(s)
    /4e5e5d7364f443e28fbf0d3ae744a59a: 1 Time(s)
    /TP/html/public/index.php: 1 Time(s)
    /TP/index.php: 1 Time(s)

    However, it appears logwatch raised the bar in 7.5.x so to get the same report you now need to set "Detail = Med" or above in the logwatch.conf file.



Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts