Lamp Blog

Logwatch，是一款专门监控Linux log（日志文件）的软件。安装以后只需要简单的配置，就可以每天将vps主机的log分析文件发送到你指定的邮箱。最好有push的邮箱，比如你的移动139邮箱，随时随刻都可以用你的智能手机监控你的vps安全状况和vps的运行状况。这样既能节省一个个手动查看日志的繁琐，有可以方便管理，为管理员节省时间，节省精力。并且每天（甚至更频繁）都能准确地接收到日志。

以下安装方法是在apt格式的Linux发行版下安装（比如Debian、ubuntu等）
运行命令：apt-get install logwatch
netren:~# apt-get install logwatch
Reading package lists… Done
Building dependency tree
Reading state information… Done
The following extra packages will be installed:
libdate-manip-perl
Suggested packages:
fortune-mod
The following NEW packages will be installed:
libdate-manip-perl logwatch
0 upgraded, 2 newly installed, 0 to remove and 0 not upgraded.
Need to get 499kB of archives.
After this operation, 2871kB of additional disk space will be used.
Do you want to continue [Y/n]?y（按y键继续，完成安装）

安装后版本是logwatch 7.3.6，并在Linux系统内生成以下文件：
/etc/logwatch （所在目录）
/etc/cron.daily/00logwatch （自动生成的日程，根据此项系统每天进行日志检查）
/usr/sbin/logwatch （logwatch命令文件）
/usr/share/logwatch/ （程序安装的位置）
/usr/share/logwatch/scripts/logwatch.pl （logwatch主文件）
/usr/sbin/logwatch （logwatch命令）
/usr/share/logwatch/default.conf/services/sshd.conf（针对sshd程序日志的管理）
/usr/share/logwatch/default.conf/services/sshd2.conf
/usr/share/logwatch/default.conf/services/stunnel.conf
………..
/usr/share/logwatch/dist.conf/logfiles
/usr/share/logwatch/dist.conf/logwatch.conf （logwatch配置文件）

logwatch配置：
vim /usr/share/logwatch/dist.conf/logwatch.conf

LogDir = /var/log
TmpDir = /var/cache/logwatch
MailTo = cracada@gmail.com
MailFrom = 1.2.3.4<syslog@mydomain.com>
Print = No
#Save = /tmp/logwatch
# Archives = Yes
# Range = All
Range = yesterday
Detail = 10
#Service = ftpd-messages # Processes ftpd messages in /var/log/messages
#Service = ftpd-xferlog # Processes ftpd messages in /var/log/xferlog
# Maybe you only wanted reports on PAM messages, then you would use:
#Service = pam_pwdb # PAM_pwdb messages - usually quite a bit
#Service = pam # General PAM messages... usually not many
#LogFile = messages
#mailer = "sendmail -t"
mailer = "msmtp -t"
#HostLimit = Yes

本人用msmtp发送邮件，详细配置见
ubuntu下用mutt和msmtp实现发送gmail邮件

输入 logwatch –mailto test@gmail.com
看看是否收到邮件内容