Instalación y configuración de logwatch

Logwatch es una herramienta que de forma diaria envia un correo resumen, de los cambios que se han realizado en los servidores. Se recorre los logs más comunes messages, last, df -h, espacio, etc.

Para su instalación:

# yum install logwatch

Una vez instalado hay que configurar  el servidor de correo. En nuestro caso usaremos postfix. Lo primero en /etc/aliases cambiaremos root por nuestra dirección de correo a enviar correos:

# vi /etc/aliases

# Person who should get root's mail
root: root@mydomain.com

En el fichero de configuración de postfix /etc/postfix/main.cf añadiremos los siguientes campos:

myhostname = myhostname.mydomain.com
mydomain = mydomain.com
mynetworks_style = subnet
relayhost = 192.168.1.3

Reiniciamos postfix:

#service postfix restart

Ejecutamos logwatch.

#logwatch

Podemos ver como sale el correo en /var/log/maillog

#tail -f /var/log/maillog
Mar 12 10:11:11 myserver postfix/smtp[20048]: 7E2361E4: to=<root@mydomain.com>, orig_to=<root>, relay=192.168.1.3[192.168.1.3]:25, delay=0.14, delays=0/0.07/0/0.06, dsn=2.6.0, status=sent (250 2.6.0  <20130312091111.7AE81177@mydomain.com> Queued mail for delivery)
Mar 12 10:11:11 myserver postfix/qmgr[19702]: 7E2361E4: removed

Lo que recibiremos en el correo es lo siguiente:

 ################### Logwatch 7.4.0 (03/01/11) ####################
        Processing Initiated: Tue Mar 12 10:39:18 2013
        Date Range Processed: yesterday
                              ( 2013-Mar-11 )
                              Period is day.
        Detail Level of Output: 0
        Type of Output/Format: stdout / text
        Logfiles for Host: myhost.mydomain.com
 ##################################################################

 --------------------- dpkg status changes Begin ------------------------
 Upgraded:
    firefox 19.0+build1-0ubuntu0.12.04.2 => 19.0.2+build1-0ubuntu0.12.04.1
    firefox-globalmenu 19.0+build1-0ubuntu0.12.04.2 => 19.0.2+build1-0ubuntu0.12.04.1
    firefox-gnome-support 19.0+build1-0ubuntu0.12.04.2 => 19.0.2+build1-0ubuntu0.12.04.1
    firefox-locale-en 19.0+build1-0ubuntu0.12.04.2 => 19.0.2+build1-0ubuntu0.12.04.1

 ---------------------- dpkg status changes End -------------------------

 --------------------- httpd Begin ------------------------

 Requests with error response codes
    404 Not Found
       /rhel63/repodata/repomd.xml: 7 Time(s)

 ---------------------- httpd End -------------------------

 --------------------- Kernel Begin ------------------------

 WARNING:  Kernel Errors Present
    ACPI Error: Method parse/ex ...:  3 Time(s)
    ACPI Error: [CAPD] Namespac ...:  3 Time(s)
    ACPI: Marking method _OSC as Serialized because of AE_ALREADY_EXISTS error ...:  1 Time(s)
    EXT4-fs (sda1): re-mounted. Opts: errors=remount-ro ...:  1 Time(s)
    EXT4-fs (sda3): mounted filesystem with ordered data mode. Opts: errors=remount-ro ...:  1 Time(s)

 ---------------------- Kernel End -------------------------

 --------------------- pam_unix Begin ------------------------
 lightdm:
    Unknown Entries:
       session closed for user lightdm: 1 Time(s)
       session opened for user lightdm by (uid=0): 1 Time(s)
       session opened for user ricard by (uid=0): 1 Time(s)

 sudo:
    Sessions Opened:
       ricard -> root: 2 Time(s)


 ---------------------- pam_unix End -------------------------

 --------------------- Connections (secure-log) Begin ------------------------

 **Unmatched Entries**
    dbus: [system] Rejected send message, 2 matched rules; type="method_call", sender=":1.27" (uid=104 pid=1933 comm="/usr/lib/indicator-datetime/indicator-datetime-ser") interface="org.freedesktop.DBus.Properties" member="GetAll" error name="(unset)" requested_reply="0" destination=":1.18" (uid=0 pid=1665 comm="/usr/sbin/console-kit-daemon --no-daemon "): 1 Time(s)
    dbus: [system] Rejected send message, 2 matched rules; type="method_call", sender=":1.35" (uid=104 pid=1977 comm="/usr/lib/indicator-datetime/indicator-datetime-ser") interface="org.freedesktop.DBus.Properties" member="GetAll" error name="(unset)" requested_reply="0" destination=":1.18" (uid=0 pid=1665 comm="/usr/sbin/console-kit-daemon --no-daemon "): 1 Time(s)
    dbus: [system] Rejected send message, 2 matched rules; type="method_call", sender=":1.59" (uid=1000 pid=2261 comm="/usr/lib/indicator-datetime/indicator-datetime-ser") interface="org.freedesktop.DBus.Properties" member="GetAll" error name="(unset)" requested_reply="0" destination=":1.18" (uid=0 pid=1665 comm="/usr/sbin/console-kit-daemon --no-daemon "): 1 Time(s)
    gnome-keyring-daemon: couldn't allocate secure memory to keep passwords and or keys from being written to the disk: 1 Time(s)
    gnome-keyring-daemon: unsupported key algorithm in certificate: 1.2.840.10045.2.1: 1 Time(s)
    gnome-screensaver-dialog: gkr-pam: unlocked login keyring: 10 Time(s)
    lightdm: pam_ck_connector(lightdm:session): nox11 mode, ignoring PAM_TTY :0: 2 Time(s)
    lightdm: pam_succeed_if(lightdm:auth): requirement "user ingroup nopasswdlogin" not met by user "ricard": 1 Time(s)
    polkitd(authority=local): Registered Authentication Agent for unix-session:/org/freedesktop/ConsoleKit/Session2 (system bus name :1.47 [/usr/lib/policykit-1-gnome/polkit-gnome-authentication-agent-1], object path /org/gnome/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8): 1 Time(s)
    polkitd(authority=local): Unregistered Authentication Agent for unix-session:/org/freedesktop/ConsoleKit/Session2 (system bus name :1.47, object path /org/gnome/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8) (disconnected from bus): 1 Time(s)

 ---------------------- Connections (secure-log) End -------------------------

 --------------------- Sudo (secure-log) Begin ------------------------

 ricard => root
 --------------
 /bin/bash                      -   2 Time(s).

 ---------------------- Sudo (secure-log) End -------------------------

 --------------------- Disk Space Begin ------------------------
 Filesystem      Size  Used Avail Use% Mounted on
 /dev/sda1        20G  5.4G   13G  30% /
 udev            1.5G  4.0K  1.5G   1% /dev
 /dev/sda3       124G  107G   11G  92% /home

 /dev/sda3 => 92% Used. Warning. Disk Filling up.

 ---------------------- Disk Space End -------------------------

 ###################### Logwatch End ######################### 

Una herramienta útil para recibir en nuestro correo el estado de los servidores a modo de resumen. El uso de logwatch no evita el tener que tener alguna otra herramienta como Nagios o Centreon que nos permita ver el estado de los servidores en tiempo real.

Hasta la próxima.