Logwatch Guide: Daily Linux Log Summaries

Logwatch is an essential log analysis tool designed to simplify system administration in Linux environments by aggregating, parsing, and summarizing system events. This article explains the primary functions of Logwatch, how it automates daily log reporting, its key configuration options, and the role it plays in system security and maintenance.

What is the Logwatch Utility?

Logwatch is a modular log-monitoring system written in Perl. Rather than requiring administrators to manually inspect expansive, raw log files stored in /var/log, Logwatch reads through specified log files, normalizes the data, filters out repetitive noise, and compiles the critical information into a readable summary report.

Primary Functions of Logwatch

1. Log Aggregation and Filtering Linux systems continuously generate gigabytes of log entries covering kernel messages, authentication attempts, network services, and application events. Logwatch parses these sprawling records to extract meaningful patterns, discarding standard operational "heartbeat" entries to highlight exceptions, errors, and significant events.

2. Automated Daily Reporting Upon installation, Logwatch typically integrates directly with the system scheduler by placing an executable script inside /etc/cron.daily/. Every 24 hours, the utility runs automatically, processes the activity from the preceding day, and prepares a standardized report.

3. Report Delivery Mechanisms Logwatch is commonly configured to dispatch reports directly to a systems administrator’s inbox using local or remote mail transfer agents (such as Postfix or Sendmail). It can also output summaries directly to standard output (stdout) for manual execution, or append them to a designated file.

4. Service-Specific Analysis The utility includes pre-built modules for standard Linux services, including:

   • SSH/Authentication: Tracks successful and failed login attempts, root escalations (sudo), and unrecognized users.
   • Web Servers (Apache, Nginx): Summarizes HTTP error codes, request volumes, and probe attempts.
   • Mail Daemons (Postfix, Exim): Tracks sent, bounced, rejected, or queued emails.
   • Disk and Filesystem: Monitors drive space usage and storage-related kernel warnings.

Configuration and Detail Control

Logwatch allows administrators to tailor reports through its main configuration file, located at /etc/logwatch/conf/logwatch.conf, or via command-line flags. Key parameters include:

• Detail Level: Administrators can set the output detail to Low (0), Medium (5), or High (10). A low setting presents only critical warnings, while a high setting displays comprehensive session metadata.
• Range: Defines the time frame analyzed, such as Yesterday, Today, or All.
• Services: Allows users to include all supported services or limit analysis to specific daemons (e.g., --service sshd).

Administrative Benefits

By consolidating complex log files into daily digests, Logwatch enables administrators to quickly spot brute-force attacks, misconfigured services, failing hardware, and unexpected reboots. It serves as a reliable first line of defense for monitoring Linux health without requiring the overhead of complex, enterprise-tier SIEM solutions.