Bjorn - 5 days ago

Did it work the next day? Or where there any changes in the environment that might have caused that?

You can also set --debug 100. As mentioned in the man page, the temporary files created in /var/cache/logwatch will not be removed after the logwatch command completes. Examine those files to see if there are any statements that should have been captured by Logwatch. That debug level will also provide much detail on what is being executed.

Remove those temporary files when no longer needed; otherwise the logwatch command will list the contents of that directory on subsequent runs.