Logwatch on Alpine doesn't show Output/Not in WATO

[b.lo]

CMK version: Checkmk Raw Edition 2.3.0p24 (DOCKER)
OS version: Ubuntu 22.04

Error message: Logwatch doesn’t show output

Hello,

recently I installed the CheckMK agent for an Alpine VM of ours. (Used this guide: Checkmk Agent für Alpine Linux – bachmann-lan.de) and it’s working fine as of now.

However, I need to monitor some of our logs and I tried to do that using logwatch.
I created the file in /etc/check_mk/logwatch.cfg and it contains the following to test the

config:
/var/log/error.log
    C error

I also placed the logwatch script on the target host: /usr/lib/check_mk_agent/plugins/mk_logwatch.py

When executing this script i get:
python /usr/lib/check_mk_agent/plugins/mk_logwatch.py -d

Traceback (most recent call last):
  File "/usr/lib/check_mk_agent/plugins/mk_logwatch.py", line 1352, in <module>
    main()
  File "/usr/lib/check_mk_agent/plugins/mk_logwatch.py", line 1280, in main
    global_options, logfiles_config, cluster_config = read_config(
                                                      ^^^^^^^^^^^^
  File "/usr/lib/check_mk_agent/plugins/mk_logwatch.py", line 406, in read_config
    raise IOError("Did not find any content in config files: %s" % ", ".join(files))
OSError: Did not find any content in config files: ./logwatch.cfg

However, if I place the logwatch.cfg in ./ i get:
python /usr/lib/check_mk_agent/plugins/mk_logwatch.py -d

<<<logwatch>>>
[[[/var/log/error.log]]]
BATCH: 1738664528-253092060014179212050089141025188009247090182017

After restarting the check_mk_agent and reinventorizing it, I still can’t see any output.
The <<< logwatch >>> section is completely missing from the agent output.

Could this be due to the way the CheckMK Agent is installed on alpine (as it is not native)?
Has anyone encountered similar problems or has any idea on how to solve this?

(I have logwatch installed on other machines that look identical to my inital setup, but for whatever reason it just doesn’t seem to work for this host.)

Thank you in advance!

[ChristianM (Christian Michaelski)]

Hi.

You need to habe the logwatch.cfg in “/etc/check_mk/” folder. When you need to test logwatch.py, please set the environment with “export MK_CONFDIR=/etc/check_MK/” first.
If you do that, you can run the plugin without an agent, and the agent can use the configuration.

RG, Christian

[b.lo]

Hi, thank you for your answer!

As mentioned above, i put my logwatch.cfg in the /etc/check_mk/ folder.
However, the <<< logwatch >>> section does not appear when executing check_mk_agent or when initialising the host via GUI

[ChristianM (Christian Michaelski)]

Hi.

Did you check that km_logwatch is executeable?

RG, Christian

[b.lo]

sorry for the late reply.
Yes, all files are executable. (mk_logwatch and the logwatch.cfg for testing purposes).

Funny thing is, when i execute the mk_logwatch.py with “python /usr/lib/check_mk_agent/plugins/mk_logwatch.py -d” i get the following output:

<<< logwatch >>>
[[[/var/log/snapshot_deletion_error.log]]]
BATCH: XXXX

And this file is created in /etc/check_mk/

logwatch-batches/local/logwatch-batch-file-XXXX

[b.lo]

I did fix some issues (LOGWATCH_DIR & MK_CONFDIR variables were empty + mk_logwatch.py interpreter path was different than my actual python installation.)

I fixed that, however when executing check_mk_agent -d i get this info for the plugin (got it before and after fixing the interpreter):

+ plugin_interpreter='<<<check_mk>>>
FailedPythonPlugins: debug_plugin.py (Missing Python 3 installation)'
+ is_valid_plugin ./mk_logwatch.py
+ '[' -f ./mk_logwatch.py ]
+ '[' -x ./mk_logwatch.py ]
+ get_plugin_interpreter ./mk_logwatch.py
+ agent_plugin=mk_logwatch.py
+ extension=py
+ filename=mk_logwatch
+ '[' py '!=' py ]
+ '[' ch '!=' _2 ]
+ '[' -n  ]
+ '[' -n  ]
+ '[' -n  ]
+ '[' '!' -e mk_logwatch_2.py ]
+ section_checkmk_failed_plugin 'mk_logwatch.py (Missing Python 3 installation)'
+ true
+ echo '<<<check_mk>>>'
+ echo 'FailedPythonPlugins: mk_logwatch.py (Missing Python 3 installation)'
+ return 1
+ plugin_interpreter='<<<check_mk>>>
FailedPythonPlugins: mk_logwatch.py (Missing Python 3 installation)'
+ is_valid_plugin '[1-9]*/*'
+ '[' -f '[1-9]*/*' ]
+ true
+ main_async_parts
+ run_real_time_checks
+ '[' -e /etc/check_mk/real_time_checks.cfg ]
+ true
+ main_finalize_sync
+ finalize_profiling
+ :
+ '['  -gt 0 ]
+ return 0

I can run the script with “python3 /usr/lib/check_mk_agent/plugins/mk_logwatch.py” without issue
My python3 installation looks fine so far. Am I missing any dependencies I am not aware of?

apk info | grep python
python3
python3-dev
python3-pyc
python3-pycache-pyc0

[b.lo]

Nevermind, I just copied the script from the CheckMK Github to my server again (checkmk/agents/plugins/mk_logwatch.py at 2.0.0 · Checkmk/checkmk · GitHub) and now it suddenly seems to work …

(I previously copied the script from my checkmk-server (~/share/check_mk/agents/plugins/mk_logwatch.py).

Both scripts and their permissions seemed identical, but somehow, it works now.