Bjorn

I don't use either Debian 12 nor journalctl (hopefully someone who does has more insight into the issues you mention), but I thought I could address some of the Logwatch-specific items you mention: * Indeed Logwatch predates journalctl by many years. In 2016 the scripts/shared/journalctl script was added to Logwatch to process logs generated by journalctl. But I don't think the Logwatch journalctl script is in widespread use. * There was a recent discussion that might help. * The LogFile = statement...

[logwatch.spec, logwatch.pl] Preparing for release 7.11

[journalctl] Added additional comments on usage.

Thanks for the insight into the cat piping. After some experimentation, I could reduce it to: in /etc/logwatch/conf/services/sshd.conf Title = "SSHD" LogFile = none *JournalCtl = "--no-pager -u sshd" *RemoveHeaders Note that it does not reference a logfile in /etc/logwatch/conf/logfiles/. When used like this, it does not attempt to concatenate logfiles. If you prefer to reference a configuration in the logfiles directory, then Peter's approach of using LogFile = LogFile = /dev/null in the appropriate...

Peter, thanks for your suggested logfile entries. Some comments: On the original report, from James, I think the unit name passed to journalctl should be "sshd" rather than "ssh." The services/sshd.conf file should also have a "Title" variable - Logwatch expects it. On Peter's solution, the transport/facility/priority options for journalctl vary were added over time, and so not all journalctl versions/distributions allow those specific entries. I see that the LogFile = /dev/null does make a difference....

[journalctl] Added comments on usage

patch: Parse LMTP and UTF8 encoding

Thanks for the patch; incorporated in repository.