Increase logwatch limits by bakery rule

Troubleshooting
,
1

CMK version:2.2.0p37
OS version:RHEL8

Hello all

in which bakery rule and parameter is it possible to increase the logwatch file size limits, so that the file size will exceeding the size of 489K?
Our problem is that the monitoring is doing its job only some hours but if the file under:
/omd/sites//var/check_mk/logwatch//
is larger than 489K no more lines are added by logwatch.
But why and where are the limits defined?

Please let me know.

Thanks
Best regards
JP

2

Rule " Text logfiles (Windows, Linux, Solaris, AIX)"

I’m not sure which parameter you need to adjust:

Limit the amount of data sent to the monitoring server / “maxoutputsize” in cfg file
Watch the total size of the log file / “maxfilesize” in cfg file

3

hello thanks but we using only the bakery, which parameter in which rule is it?
On the host we don’t have any access.

4

Logwatch is not planed to be used as log collector with history of all logs. You should define logwatch rules so that only monitoring relevant log entries are saved. Everything else should be discarded. And it is important that someone is overseeing the incoming messages, fix it or at least forward it to a person responsible and clear the log file on the CheckMK server. The 500k limit is by the way on the CheckMK server side, not on the agent.

5

Hello Udo
Thanks but what is the rule name with the parameter to find in Checkmk in which section?
Do you’ve a screenshot for us please?
Please let us know.
Thanks

6

Search for “Logfile patterns”. With this you can define patterns to ignore log file entries that you want to get rid of.
grafik

7

Hello Udo
Sorry but we searching the parameter to increase the files size of logwatch.
We whats to get the log informations not discard them by rules.
The file size is just to increase.
But how?

8

As far as I know this is not possible. As I wrote before log archiving is not the intended use of logwatch. Better use Splunk for this.

9

This topic was automatically closed 365 days after the last reply. New replies are no longer allowed. Contact an admin if you think this should be re-opened.