How to configure logwatch.cfg to exclude patterns?

c3rberus
Mon, 23 Aug 2021 15:15:24 +0000

Hello,

We are running 1.6p8 instance of CMK EE, using logwatch to forward/alert on certain logs.

Our logwatch.cfg is below:

/usr1/dbs/*.log maxlinesize=1024
C (?i)ERROR
C (?i)WARNING

There are some logs that appear with the ERROR/WARNING text that are just noise and I don’t need to forward these for further processing. How can I drop these while forwarding everything else that matches?

One of the warnings that I don’t need appear in the log file as: “WARNING User not licensed.”

I tried adding…

I (?i)user not licensed

This did not work. I did not find a lot of docs on logwatch configuration file.

Logs are forwarded to EC.