Test output without any config file.
1086 0 large_rawcount
1088 9 large_rawcount
1090 0 bulk_count
1092 0 bulk_count
1094 8532 large_rawcount
<<<logwatch>>>
[[[Application]]]
[[[Cisco AnyConnect AMP Enabler Module]]]
[[[Cisco AnyConnect Network Access Manager]]]
[[[Cisco AnyConnect Network Visibility Module]]]
[[[Cisco AnyConnect Posture Module]]]
[[[Cisco AnyConnect Secure Mobility Client]]]
[[[Cisco AnyConnect Umbrella Roaming Security Module]]]
[[[Cisco AnyConnect Web Security Module]]]
[[[HardwareEvents]]]
[[[Internet Explorer]]]
[[[Key Management Service]]]
[[[Parameters:missing]]]
[[[Security]]]
[[[State:missing]]]
[[[System]]]
[[[Windows PowerShell]]]
<<<logwatch>>>
<<<>>>
<<<>>>
with the following ini
[global]
sections = check_mk uptime df ps mem services winperf systemtime plugins local spool fileinfo
output looks like this
1086 0 large_rawcount
1088 1 large_rawcount
1090 0 bulk_count
1092 0 bulk_count
1094 8395 large_rawcount
<<<>>>
<<<>>>
<<<local>>>
<<<systemtime>>>
Booth logwatch sections are missing. I think that is what you want. The old agent had no possibility to disable single sections you had to define all other sections as “wanted”.