How to configure logwatch.cfg to exclude patterns?

c3rberus · August 23, 2021, 3:15pm

Hello,

We are running 1.6p8 instance of CMK EE, using logwatch to forward/alert on certain logs.

Our logwatch.cfg is below:

/usr1/dbs/*.log maxlinesize=1024
C (?i)ERROR
C (?i)WARNING

There are some logs that appear with the ERROR/WARNING text that are just noise and I don’t need to forward these for further processing. How can I drop these while forwarding everything else that matches?

One of the warnings that I don’t need appear in the log file as: “WARNING User not licensed.”

I tried adding…

I (?i)user not licensed

This did not work. I did not find a lot of docs on logwatch configuration file.

Logs are forwarded to EC.

andreas-doehler · August 24, 2021, 4:48am

This will only work with the “I” ignore line. In your test why is there a “(?!)” in the ignore line?
As a reference for the config file the example config is a good start.

github.com

tribe29/checkmk/blob/master/agents/cfg_examples/logwatch.cfg

# Copyright (C) 2019 tribe29 GmbH - License: GNU General Public License v2
# This file is part of Checkmk (https://checkmk.com). It is subject to the terms and
# conditions defined in the file COPYING, which is part of this source code package.

# logwatch.cfg
# This file configures mk_logwatch. Define your logfiles
# and patterns to be looked for here.

# Name one or more logfiles, and the options to be applied (if any)
"/var/log/messages" maxlinesize=1024 encoding=utf-8
# Patterns are indented with one space are prefixed with:
# C: Critical messages
# W: Warning messages
# I: ignore these lines (OK)
# R: Rewrite the output previous match. You can use \1, \2 etc. for
#    refer to groups (.*) of this match
# The first match decides. Lines that do not match any pattern
# are ignored
 C Fail event detected on md device
 I mdadm.*: Rebuild.*event detected

This file has been truncated. show original

system · August 24, 2022, 4:48am

This topic was automatically closed 365 days after the last reply. New replies are no longer allowed. Contact an admin if you think this should be re-opened.