Logwatch not showing any output

Hi,

I’m trying to monitor some logfiles using the mk_logwatch plugin. In the output I can see that at least it has found my logfile:

Log /var/log/svnserve.log OK - no error messages

But no matter what gets written in the log no error of warning is ever reported. In /etc/check_mk/logwatch.cfg I have:

/var/log/svnserve.log
C ERR
W WARN

If I look in the output of check_mk again, there’s no messages:

<<<logwatch>>>
[[[/var/log/svnserve.log]]]

Even though I’m 100% sure errors were logged since the time I’ve enabled the plugin. These messages look something Like this:

21276 2020-07-03T09:03:04.508438Z 69.4.93.212 - - ERR - 0 210004 Malformed network data

So, far as I can see it should have matched the ERR condition I specified. If I run the plugin manually however, it does see the error message:

./mk_logwatch
<<<logwatch>>>
[[[/var/log/svnserve.log]]]
C 21276 2020-07-03T09:03:04.508438Z 69.4.93.212 - - ERR - 0 210004 Malformed network data

So how do I get this data to show up on the check_mk server? I’m running CheckMK 1.6.0p13 on debian 10.

Wich user are you using for running the plugin manually? Maybe the plugin needs sudo permissions?

I run as the check_mk user which I use to run the check_mk agent. This user has read rights on the logfile.

Can you run both the agent and the plugin script with the -d argument? This turns on debug output, maybe it will reveal something…

I just tried that. If I run the logwatch script with -d it basically outputs the whole log, so I get something like this:

./mk_logwatch -d
<<<logwatch>>>
[[[/var/log/svnserve.log]]]
. 16827 2018-07-13T12:37:38.729019Z 217.23.13.201 louis Digio checkout-or-export / r164
C 21678 2018-07-14T05:49:39.098216Z 122.228.10.50 - - ERR - 0 210004 Malformed network data
. 21919 2018-07-14T06:59:18.412844Z 217.23.13.201 louis Digio get-latest-rev
. 21919 2018-07-14T06:59:18.451383Z 217.23.13.201 louis Digio reparent /
. 21919 2018-07-14T06:59:18.565825Z 217.23.13.201 louis Digio update / r164
C 11418 2018-07-22T08:57:02.277026Z 78.128.112.22 - - ERR - 0 210004 Malformed network data
C 16171 2018-07-24T15:41:28.443567Z 122.228.10.50 - - ERR - 0 210004 Malformed network data

In the output of the agent however, it’s still the same:

/usr/bin/check_mk_agent -d

<<<logwatch>>>
[[[/var/log/svnserve.log]]]

Never mind. I’ve solved the issue. Must have been a rights issue after all. I’ve changed access to the agent from using ssh to xinetd. That took care of this issue. I guess that when using xinetd you have root permission on the system.

Anyway, thanks for the help.

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.