Red Hat Bugzilla – Bug 189638
logwatch does not handle the --logdir option correctly
Last modified: 2007-11-30 17:07:24 EST
Description of problem:
According to the man page for logwatch the "--logdir" option is supposed
to tell logwatch where to look for log files. In that light, please
consider the following, and then see my comments at the end:
[root@opus httpd]# logwatch --logfile http --mailto email@example.com --debug 5 --logdir /var/log/
Preprocessing LogFile: http
/var/log/httpd/tmp/httpd/*access_log 2>/dev/null |
export http_fields='client_ip ident userid timestamp request http_rc
bytes_transfered referrer agent'
export http_format='space space space brace quote space
So you can see that I've specified the "/var/log/httpd/tmp" directory using
the "--logdir" option. However, the debug display clearly shows that the
script is trying to read the "/var/log/httpd/tmp/log/httpd/" directory!
It would appear that the script is prepending my specified logdir to the
default path that's configured in the /etc/log.d/conf/logfiles/http.conf
file, rather than simply use the directory I specified. In other words,
if I specify a directory using --logdir then logwatch should look in
that directory for log files, and in that case the default paths should
Version-Release number of selected component (if applicable):
[root@opus httpd]# ident `which logwatch`
$Id: logwatch.pl,v 1.113 2004/06/23 15:01:17 kirk Exp $
Steps to Reproduce:
1. Copy some log files to some non-standard location
2. Run logwatch with the --logdir option to specify tht non-standard location
3. Observe that (most likely) no report will be produced.
4. Run logwatch again with debug turned on to reveal that logwatch is NOT looking
in the directory specified, but has apparently used the specified directory as the relative
starting point for its search for log files.
logwatch either does not produce a report, because there are no log files in the (incorrect)
location where it's looking; or, it produces the wrong report because it is looking at the
wrong log files.
logwatch should look in the directory I specify in order to find the log files I want it to analyze.
The --logdir option seems to be right in your example.
Logwatch go through files
the logdir is set to 'var/log/httpd/tmp'
but the parsed files are
1/ 'log/httpd/access_log' - file '/httpd/access_log' which is in LogFile was not
found in /var/log/httpd/tmp/, so logwatch use 'log/httpd/access_log' (this is
only done for log_file_names which represent files existing in /var/log dir) and
2/ 'httpd/*access_log' ('/var/log/httpd/*access_log' is not file. Logwatch does
not add string log.)
- log file names are set in /etc/log.d/conf/logfiles/http.conf (LogFile variable).
There is necessary to add the relative path to given logdir path becouse of
different services has log files in various subdirectories. So if you want to
display logwatch output relevant to all services you can set only one logdir
path. Logwatch supposes that the log files directory has the same structure as
If there is any problem, please reopen this bug.
Thanks for the explanation. I gather, therefore, that the directory specified with the "--logdir" option on
the command line is a *relative* path, not an *absolute* path. That is, logwatch will use the specified
directory as a "starting point" for finding log files, rather than look for log files exactly where I tell it,
and nowhere else. That's fine. I can live with that, and adjust.
However, the man page on this subject is vague, and does not make it clear that the directory specified
with the "--logdir" option will be used as an alternate "root" path for logwatch, and that a directory
heirarchy with the same structure as /var/log is expected.
Therefore, can we change this to a documentation bug, and get the man page written more clearly?