By Lubos Kosco on Feb 02, 2007
For those of you, who don't know logwatch, it's a perl script, which prepares log reports from your system and sends them to you.
On Linux (read: Debian ) systems this small tool is enabled by default & I enjoy it, because it can help monitor your machines and give you an overview what's going on there.
Sooo the other day I was thinking about putting up logwatch for tomcat on one of our Sparc boxes with Solaris 9 (yeah, I know, S10 rulez, but we need S9 for legacy stuff).
But since I am not only a man of thinking, I went & downloaded logwatch source, put it on my box, installed and was wondering if logwatch supports tomcat out of box ... bummer! It's not!
Hmm ... now I was thinking ... tomcat logs which I wanted to be analyzed are not the usual catalina.out, but I turned on access logging, which formats out strings very similar to apache(http).
So why not go & use logwatchs "http" service ???
YEAH, small change to <logwatch_basedir>/default.conf/logfiles/http.conf to add:
LogFile = localhost_access_log\*
LogFile = logs/localhost_access_log\*
and it all worked like charm
But since I needed one more feature - counting of unique IPs which accessed my server, I had to develop it and that's how MY tomcat service saw the light of world ... it supports apache log files as well, so to avoid double reports when installing this service, use service="-http" .
Now I am a happy user of weekly report from my tomcat logwatch service (download in Resources section, NO Support)
logwatch --help is your friend
--logdir is a good parameter as well
(you will probably need to unpack it to /usr/share/logwatch/ )