How can I get logwatch to process alternate apache logs?

Question

CentOS 5 | Apache 2.2.3 | LogWatch 7.3

Hello All,

I have Apache running on a CentOS box and am hosting multiple VirtualHosts. Each of these virtual hosts has a separate access log. For example:

/var/log/httpd/example.foo.com-access_log /var/log/httpd/downloads.foo.com-access_log

The main site is writing logs to /var/log/httpd/access_log.

LogWatch appears to only be checking the main log files. How can I tell it to include the other files too?

I thought there might be a pointer somewhere in /usr/share/logwatch/scripts/services/http but I didn't see it there.

Any thoughts?

-M

Solution

The log files you have provided should be picked up without you making any changes because of the default config

LogFile = httpd/*access_log
LogFile = apache/*access.log.1
LogFile = apache/*access.log
LogFile = apache2/*access.log.1
LogFile = apache2/*access.log
LogFile = apache-ssl/*access.log.1
LogFile = apache-ssl/*access.log

But is you want to be more specific you can create a config file in /etc/logwatch/conf such as /etc/logwatch/conf/logfiles/http.conf with

Logfile = /var/log/httpd/downloads.foo.com-access_log
...
...

Comments

[Mike B]

Awesome. Thank you! Are there any services I need to bounce after making changes?

[topdog]

No logwatch is run by cron so you don't have to bounce anything, you can even test it on the command line using logwatch --print

[dunxd]

Note that your logwatch reports won't specify which logfile a particular item came from (e.g. Local File Inclusion probes) with combined logfile format.

[crafter]

While this may work great if all the directories are known, I am using the i-mspcp control panel which places apache logs in its own own subdirectory /var/log/apache/domain1/access-log, /var/log/apache/domain2/access-log, and so on. How can I configure this using wildcards.?