Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

The default config for http-error logs in Logwatch on a CentOS 5 box (logwatch-7.4.0-1) includes the line:

*ApplyhttpDate

That wipes out all lines, because Apache 2.2 uses StdDate format (e.g. Fri Sep 21 04:44:55 2012) not the standard Apache format (e.g. 04/Sep/2012:13:46:40 -0500).

The HOWTo-Customize-LogWatch file says:

If an executable script is declared in an /etc/logwatch/conf file, all of the executable script declarations in the corresponding file in /usr/share/logwatch/default.conf or /usr/share/logwatch/dist.conf are ignored.

If I create /etc/logwatch/conf/logfiles/http-error.conf and set

*ApplyStdDate

then it applies the StdDate filter after it has applied HttpDate filtering, rather than instead of.

Other than editing /usr/share/logwatch/default.conf/logfiles/http-error.conf (which I've resorted to for now, but shouldn't do because it is provided by an RPM) how am I supposed to disable a filter script in Logwatch?

share|improve this question
    
Sigh, I am having the same problem with logwatch-7.3.6 on RHEL6. Did you ever get this resolved? –  Danny Jun 13 at 18:06
    
I'm using CentOS 6 now which only has logwatch-7.3.6 and the http-error.conf no longer seems to be part of the package, so my problem has gone away by itself. I never did find a clean solution that didn't involve editing the RPM packaged file. My http-error reporting is now done by a manually installed file under /etc. –  IBBoard Jun 15 at 13:55

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.