Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The default config for http-error logs in Logwatch on a CentOS 5 box (logwatch-7.4.0-1) includes the line:


That wipes out all lines, because Apache 2.2 uses StdDate format (e.g. Fri Sep 21 04:44:55 2012) not the standard Apache format (e.g. 04/Sep/2012:13:46:40 -0500).

The HOWTo-Customize-LogWatch file says:

If an executable script is declared in an /etc/logwatch/conf file, all of the executable script declarations in the corresponding file in /usr/share/logwatch/default.conf or /usr/share/logwatch/dist.conf are ignored.

If I create /etc/logwatch/conf/logfiles/http-error.conf and set


then it applies the StdDate filter after it has applied HttpDate filtering, rather than instead of.

Other than editing /usr/share/logwatch/default.conf/logfiles/http-error.conf (which I've resorted to for now, but shouldn't do because it is provided by an RPM) how am I supposed to disable a filter script in Logwatch?

share|improve this question
Sigh, I am having the same problem with logwatch-7.3.6 on RHEL6. Did you ever get this resolved? – Danny Jun 13 '14 at 18:06
I'm using CentOS 6 now which only has logwatch-7.3.6 and the http-error.conf no longer seems to be part of the package, so my problem has gone away by itself. I never did find a clean solution that didn't involve editing the RPM packaged file. My http-error reporting is now done by a manually installed file under /etc. – IBBoard Jun 15 '14 at 13:55

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.