i already set the checkmk plugin like that
Checkmk force logwatch to read file from the beginning - #12 by andreas-doehler to force the plugin to read from the begin of log file
also i’ve this configuration in my logwatch.cfg
"path/*.log" fromstart=True
W NOK
W previous
C error
I OK