How to configure logwatch.cfg to exclude patterns?

andreas-doehler
Tue, 24 Aug 2021 04:48:27 +0000

This will only work with the “I” ignore line. In your test why is there a “(?!)” in the ignore line?
As a reference for the config file the example config is a good start.

github.com

tribe29/checkmk/blob/master/agents/cfg_examples/logwatch.cfg

# Copyright (C) 2019 tribe29 GmbH - License: GNU General Public License v2
# This file is part of Checkmk (https://checkmk.com). It is subject to the terms and
# conditions defined in the file COPYING, which is part of this source code package.

# logwatch.cfg
# This file configures mk_logwatch. Define your logfiles
# and patterns to be looked for here.

# Name one or more logfiles, and the options to be applied (if any)
"/var/log/messages" maxlinesize=1024 encoding=utf-8
# Patterns are indented with one space are prefixed with:
# C: Critical messages
# W: Warning messages
# I: ignore these lines (OK)
# R: Rewrite the output previous match. You can use \1, \2 etc. for
#    refer to groups (.*) of this match
# The first match decides. Lines that do not match any pattern
# are ignored
 C Fail event detected on md device
 I mdadm.*: Rebuild.*event detected

This file has been truncated. show original