The default config for http-error logs in Logwatch on a CentOS 5 box (logwatch-7.4.0-1) includes the line:
That wipes out all lines, because Apache 2.2 uses StdDate format (e.g.
Fri Sep 21 04:44:55 2012) not the standard Apache format (e.g.
The HOWTo-Customize-LogWatch file says:
If an executable script is declared in an /etc/logwatch/conf file, all of the executable script declarations in the corresponding file in /usr/share/logwatch/default.conf or /usr/share/logwatch/dist.conf are ignored.
If I create /etc/logwatch/conf/logfiles/http-error.conf and set
then it applies the StdDate filter after it has applied HttpDate filtering, rather than instead of.
Other than editing
/usr/share/logwatch/default.conf/logfiles/http-error.conf (which I've resorted to for now, but shouldn't do because it is provided by an RPM) how am I supposed to disable a filter script in Logwatch?