Logwatch是一款专门监测Linux log文件（日志文件）的软件。安装以后稍微配置，就能每天将主机的log分析文件发送至指定的邮箱。能节省一个个手动查看日志的繁琐，为管理员节省时 间，节省精力。并且每天（甚至更频繁）都能准确地接收到日志。从而对服务器的安全情况有所掌握。
[root@localhost ~]# vi /usr/share/logwatch/default.conf/logwatch.conf
查找 MailTo =root ，将root修改为自己的Email地址，如 MailTo = user@domain.com
Detail = low细节度，将low修改为high或 10即最高（推荐）。
logwatch默认为每天执行一次（cron.daily）。
[root@localhost ~]# cd /etc/cron.daily/
[root@localhost cron.daily]#ls –l
总计 72
………………………………………………………………
lrwxrwxrwx 1 root root 39 09-10 14:29 0logwatch -> /usr/share/logwatch/scripts/logwatch.pl
………………………………………………………………
手动执行：# perl /usr/sbin/logwatch
也可以把上述路径放入crontab里面在特定时间里自动执行
手动执行logwatch的命令为：
#logwatch –print将昨天的日志信息简要的打印出来。如用户登录失败信息、SSH 登录信息、磁盘空间使用等
[root@localhost cron.daily]# logwatch --print
################### Logwatch 7.3 (03/24/06) ####################
Processing Initiated: Wed Sep 15 15:27:38 2010
Date Range Processed: yesterday( 2010-Sep-14 )Period is day.
Detail Level of Output: 0
Type of Output: unformatted
Logfiles for Host: localhost.localdomain
##################################################################
-------------------- Selinux Audit Begin ------------------------
Number of audit daemon stops: 1
---------------------- Selinux Audit End -------------------------
--------------------- Automount Begin ------------------------
**Unmatched Entries**
lookup_read_master: lookup(nisplus): couldn't locate nis+ table auto.master: 2 Time(s)
---------------------- Automount End -------------------------
--------------------- pam_unix Begin ------------------------
login:
Authentication Failures:
root (): 1 Time(s)
---------------------- pam_unix End -------------------------
--------------------- Connections (secure-log) Begin ------------------------
Failed logins:
User root:
(null): 1 Time(s)
Root logins on tty's: 2 Time(s).
---------------------- Connections (secure-log) End -------------------------
--------------------- Smartd Begin -----------------------
**Unmatched Entries**
Device: /dev/hdc, packet devices [this device CD/DVD] not SMART capable
Device /dev/sda: using '-d sat' for ATA disk behind SAT layer.
Device: /dev/sda, lacks SMART capability
Device: /dev/sda, to proceed anyway, use '-T permissive' Directive.
Device: /dev/hdc, packet devices [this device CD/DVD] not SMART capable
Device /dev/sda: using '-d sat' for ATA disk behind SAT layer.
Device: /dev/sda, lacks SMART capability
Device: /dev/sda, to proceed anyway, use '-
Device: /dev/sda, to proceed anyway, use '-T permissive' Directive.
---------------------- Smartd End -------------------------
--------------------- SSHD Begin ------------------------
SSHD Killed: 1 Time(s)
SSHD Started: 2 Time(s)
---------------------- SSHD End -------------------------
--------------------- Disk Space Begin ------------------------
Filesystem Size Used Avail Use% Mounted on
/dev/sda2 5.7G 3.3G 2.2G 60% /
/dev/sda1 99M 17M 78M 18% /boot
/dev/hdc 3.8G 3.8G 0 100% /media/CentOS_5.4_Final
---------------------- Disk Space End -------------------------
###################### Logwatch End #########################
这样查看似乎很长，可以单独查看某个服务的日志记录情况；
[root@localhost ~]# logwatch --service sshd --print
################### Logwatch 7.3 (03/24/06) ####################
Processing Initiated: Wed Sep 15 15:36:15 2010
Date Range Processed: yesterday
( 2010-Sep-14 )
Period is day.
Detail Level of Output: 0
Type of Output: unformatted
Logfiles for Host: localhost.localdomain
##################################################################
--------------------- SSHD Begin ------------------------
SSHD Killed: 1 Time(s)
SSHD Started: 2 Time(s)
---------------------- SSHD End -------------------------
###################### Logwatch End #########################
# logwatch –help查看logwatch的帮助信息，可以对配置文件进行设置。
默认有 70 多种 Log 的配置信息. 如果要对特殊 Log 做监控，基本的做法：
1) 创建一个日志文件组。指定自己的 Log 文件,可以是一个，可以是多个
2) 创建一个新的服务。指明这个服务的名字, 指明 Log 文件来源(来自上一步的定义)
3) 创建一个过滤脚本