Peter Lebbing

When used like this, it does not attempt to concatenate logfiles. Thanks for the insight! Note, though, that to fully support logwatch's --range argument, you will also need *ApplyStdDate. This is because not all --ranges are translated to argument to journalctl, so you can end up with the full journal. You can see it like this: /etc/logwatch/conf/services/test.conf Title = "Test" LogFile = none *JournalCtl = "--no-pager -u ssh" #*RemoveHeaders /etc/logwatch/scripts/services/test: #!/bin/sh cat I...

When used like this, it does not attempt to concatenate logfiles. Thanks for the insight! Note, though, that to fully support logwatch's --range argument, you will also need *ApplyStdDate. This is because not all --ranges are translated to argument to journalctl, so you can end up with the full journal. You can see it like this: /etc/logwatch/conf/services/test.conf Title = "SSHD" LogFile = none *JournalCtl = "--no-pager -u ssh" #*RemoveHeaders /etc/logwatch/scripts/services/test: #!/bin/sh cat I...

When used like this, it does not attempt to concatenate logfiles. Thanks for the insight! Note, though, that to fully support logwatch's --range argument, you will also need *ApplyStdDate. This is because not all --ranges are translated to argument to journalctl, so you can end up with the full journal. You can see it like this: /etc/logwatch/conf/services/test.conf Title = "SSHD" LogFile = none *JournalCtl = "--no-pager -u ssh" #*RemoveHeaders /etc/logwatch/scripts/services/test: #!/bin/sh cat I...

Need to investigate why "none" or a null entry does not work. I think because the JournalCtl script is a filter operating on an input file. It ignores the input file, so it can be any file at all, but there needs to be a file. If you don't specify any log file at all, I think the script is never run. With /dev/null, it runs something like cat /dev/null | .../shared/journalctl ..., piping the "log file" to the script. On Peter's solution, the transport/facility/priority options for journalctl vary...

Need to investigate why "none" or a null entry does not work. I think because the JournalCtl script is a filter operating on an input file. It ignores the input file, so it can be any file at all, but there needs to be a file. If you don't specify any log file at all, I think the script is never run. With /dev/null, it runs something like cat /dev/null | .../shared/journalctl ..., piping the "log file" to the script.

I'm playing around more with logwatch. It seems to run quicker if you remove the -o shortiso, and I'm fairly sure it doesn't change functionality in any way. So it's better to do it like this: secure: LogFile = LogFile = /dev/null *JournalCtl = "_TRANSPORT=syslog --facility=auth,authpriv" *ExpandRepeats *ApplyStdDate messages: LogFile = LogFile = /dev/null *JournalCtl = "_TRANSPORT=syslog --priority=warning..info --facility=ftp,kern,lpr,news,syslog,user,uucp,local0,local1,local2,local3,local4,local5,local6,local7"...

I think the documentation is somewhat mistaken and you need this: LogFile = LogFile = /dev/null *JournalCtl = "--no-pager -u ssh" I've solved it differently; I've replaced all the default log files from rsyslog by journalctl output (and removed rsyslog from my system). The ssh logwatch uses secure and messages, so those have become: secure: LogFile = LogFile = /dev/null *JournalCtl = "-o short-iso _TRANSPORT=syslog --facility=auth,authpriv" *ExpandRepeats *ApplyStdDate messages: LogFile = LogFile...

I would like to propose to split the option "Encrypt/sign replies to encrypted/signed...