Hi,
Well it would help if you could share part of the logfile you’re trying to analyse and what you’re hoping to achieve.
But in general the configuration ignores everything except when explicitly specified.And it works on a first match basis. So let’s say I have this in logwatch.cfg:
C:\tmp\checkmk.log
I error.jsp
W warning
C error
And in the checkmk.log you get messages like this:
error, something's wrong
cannot read file error.jsp
warning: an error occurred
Now the first one’s easy, it will triggar an error as it matches on the “C error” line. However, the second one will be ignored. Indeed it has the keyword error in it, but it matches “I error.jsp” first. And after the first match logwatch will stop processing and continue to the next line in the logfile, which according to similar logics will trigger a warning.
Hope this helps clarify a bit.
Regards,
Louis