Logwatch

Logwatch is a tool that will monitor your server's logs and email the administrator a digest on a daily basis.

* Ensure email is working. Instructions for doing so may be found in MailServer.

* Turn on universe repository. Instructions for doing so may be found in Repositories.

Update your package list with:

$ sudo apt-get update

Install Logwatch with:

$ sudo apt-get install logwatch

Create a directory the Logwatch package in the repositories currently does not create, but is required for proper operation:

$ sudo mkdir /var/cache/logwatch

Configuration shouldn't be edited in the install directory (/usr/share/logwatch). Copy logwatch.conf to /etc/logwatch before editing:

$ sudo cp /usr/share/logwatch/default.conf/logwatch.conf /etc/logwatch/conf/

Edit logwatch.conf to put in the e-mail where you want the report sent:

MailTo = me@example.com

Detail level of the logwatch report can be Low, Med or High. Default level is Low. To change that, edit the newly copied logwatch.conf:

Detail = High

For Ubuntu systems with apache server:

Copy /usr/share/logwatch/default.conf/logfiles/http.conf to /etc/logwatch/conf/logfiles

and add *combined.log files to the list

• (en) Logwatch customization Howto