Logwatch is a very flexible and customizable log watching system for lazy system administrators. It checks the logfiles regularly and sends custom mail reports – very useful and way better than daily manual checking of the logs.
Unfortunately the configuration for MySQL, PHP and the Apache error_log is missing; so let me share the configuration scripts:
Logwatch configuration for PHP
Interestingly there is no logwatch configuration for PHP error_log files – and all a search revealed are some outdated files which don’t work anymore. Here are the adopted files that allow you to get notified about PHP errors:
- logfiles_php.conf – place this file in /etc/logwatch/conf/logfiles/php.conf and adopt the path to the php error_log file (or just use the Apache error_log)
- services_php.conf – place this file in /etc/logwatch/conf/services/php.conf
- scripts_php – place this file in /etc/logwatch/scripts/php and make it executable
Logwatch configuration for MySQL
Also a configuration for MySQL is missing in the default configuration; here are the configuration files:
- logfiles_mysql.conf – place this file in /etc/logwatch/conf/logfiles/mysql.conf and adopt the path to the MySQL logfile
- services_mysql.conf – place this file in /etc/logwatch/conf/services/mysql.conf
- scripts_mysql – place this file in /etc/logwatch/scripts/mysql and make it executable
Logwatch configuration for Apache’s error_log
Now hat really made me wonder is the at the httpd access_log is monitored but the error_log is left out, so no details about errors are included in the logs. This configuration ignores PHP errors and includes all httd errors in the logwatch output:
- logfiles_http-error.conf – place this file in /etc/logwatch/conf/logfiles/http-error.conf and adopt the path to the httpd error_log file accordingly
- services_http-error.conf – place this file in /etc/logwatch/conf/services/http-error.conf
- scripts_http-error – place this file in /etc/logwatch/scripts/http-error and make it executable
To test that the individual scripts work use this command:
/usr/sbin/logwatch –detail high –print –service $SERVICE –range today –debug 0
Replace $SERVICE with either php, mysql or http-error and set debug to 5 if you want to see more (but not too much) debugging information.
All the logwatch configuration scripts for MySQL, PHP and the Apache error_log can be found here.
Update: There was an error in the scripts_mysql file, fixed now.