Logwatch is a very flexible and customizable log watching system for lazy system administrators. It checks the logfiles regularly and sends custom mail reports – very useful and way better than daily manual checking of the logs.
Unfortunately the configuration for MySQL, PHP and the Apache error_log is missing; so let me share the configuration scripts:
Logwatch configuration for PHP
Interestingly there is no logwatch configuration for PHP error_log files – and all a search revealed are some outdated files which don’t work anymore. Here are the adopted files that allow you to get notified about PHP errors:
- logfiles_php.conf – place this file in /etc/logwatch/conf/logfiles/php.conf and adopt the path to the php error_log file (or just use the Apache error_log)
- services_php.conf – place this file in /etc/logwatch/conf/services/php.conf
- scripts_php – place this file in /etc/logwatch/scripts/php and make it executable
Logwatch configuration for MySQL
Also a configuration for MySQL is missing in the default configuration; here are the configuration files:
- logfiles_mysql.conf – place this file in /etc/logwatch/conf/logfiles/mysql.conf and adopt the path to the MySQL logfile
- services_mysql.conf – place this file in /etc/logwatch/conf/services/mysql.conf
- scripts_mysql – place this file in /etc/logwatch/scripts/mysql and make it executable
Logwatch configuration for Apache’s error_log
Now hat really made me wonder is the at the httpd access_log is monitored but the error_log is left out, so no details about errors are included in the logs. This configuration ignores PHP errors and includes all httd errors in the logwatch output:
- logfiles_http-error.conf – place this file in /etc/logwatch/conf/logfiles/http-error.conf and adopt the path to the httpd error_log file accordingly
- services_http-error.conf – place this file in /etc/logwatch/conf/services/http-error.conf
- scripts_http-error – place this file in /etc/logwatch/scripts/http-error and make it executable
To test that the individual scripts work use this command:
/usr/sbin/logwatch –detail high –print –service $SERVICE –range today –debug 0
Replace $SERVICE with either php, mysql or http-error and set debug to 5 if you want to see more (but not too much) debugging information.
All the logwatch configuration scripts for MySQL, PHP and the Apache error_log can be found here.
Update: There was an error in the scripts_mysql file, fixed now.
Very useful, thanks.On my Ubuntu server, scripts must be place under/etc/logwatch/scripts/services/*and not under ./scripts/* directly as you write.Best regards,Alexandrehttp://alexandre.alapetite.fr
hi therei was looking for some like that. many thanks i only have a little issue i use your mysql.logwatch stuff on rhel5 , and in that distro the files must be placed in /usr/share/logwatch/scripts/services/so i create a symlink … ln -s /etc/logwatch/scripts/mysql /usr/share/logwatch/scripts/services/mysql i think this issue could be useful on any rhel based distros cheers
Awesome, thanks!
There was an error in the mysql Perl script, this is fixed now.
In Fedora 10, I only had to supply the files /etc/logwatch/conf/logfiles/php.conf and /etc/logwatch/conf/services/php.con to get php logging working in LogWatch. I also changed LogFile = http-error to LogFile = http in /etc/logwatch/conf/services/php.conf because I didn't implement the http-error plugin above.
When I try to use these, I always get an error.The error is Undefined subroutine &main::TimeFilter called at /etc/log.d/scripts/services/php line 23.Any ideas why I might be getting this?
Thank you very much for these usefull logwatch templates! They work great!
I use Logfile = http in http.conf to log multiple log (some virtual hosting).
But in report received I cannot see logs filtered for domain-name, but only a cumulative report.
Es.:
8.61 MB transferred in 2127 responses (1xx 0, 2xx 1754, 3xx 177, 4xx 196, 5xx 0)
215 Images (3.75 MB),
531 Content pages (4.36 MB),
111 Redirects (0.02 MB),
1270 Other (0.47 MB)
Requests with error response codes
401 Unauthorized
/admin/: 1 Time(s)
/iphone: 2 Time(s)
/phpmyadmin: 133 Time(s)
/myphpadmin: 46 Time(s)
—
how can I see this report for each log of domain name?
regards,
Morin
Hi Morin!
I don’t think logwatch supports individual virtual hosts (none of the sections). So you might have to create different configurations for the individual log files our you have to tweak the script to render the information you want to have.
Thanks Michael. This was very helpful. On Centos you must place the script under /etc/logwatch/scripts/services/ instead as a previous poster mentioned for Ubuntu systems.
Hello, I am unable to get it working. I get following errors while trying to generate an logwatch report.
print() on unopened filehandle OUTFILE at /usr/sbin/logwatch
Please let me know if there is a work around for this.
Problems seems to be with the “script” file. I replaced the parsing script to as put STDIN to STDOUT and it worked perfectly.
@morin
I changed the logging in Apache to see the domain on the server.
See http://blog.jachim.be/2009/11/hostnames-in-logwatch-reports/