Skip to main content
cPanel Technical Support has been heavily impacted by hurricane Beryl and our ability to respond to tickets has been hindered as a result. We appreciate your understanding and patience as we address these delays.

Logwatch failed to complete successfully

Comments

8 comments

  • Eric
    Howdy, Normally logwatch is an email to the root users /root/.forward email address. Are you getting the emails or an error when the cronjobs? Thanks!
    0
  • dancingpony
    I'm getting the emails. I'm assuming they are sent when cron.daily runs and it sees that I have those 'old files in your logwatch tmpdir'
    0
  • cPanelMichael
    Hello @dancingpony, Could you paste the output from your logwatch cron job and logwatch configuration file? You can do so with commands such as:
    cat /etc/cron.daily/0logwatch cat /etc/logwatch/conf/logwatch.conf
    Also, try running the "/usr/sbin/logwatch" and "stat /var/cache/logwatch" commands to review the permission/ownership values on "/var/cache/logwatch" and to check for any specific error output when running the logwatch command manually. Additionally, use the "df -h" and "df -i" commands to make sure your /var partition isn't at it's disk space or inode limit. Thank you.
    0
  • dancingpony
    Hi @cPanelMichael The output of the 'cron.daily' command has almost 1400 lines - do you need all of it? The output of the 'conf' file is as below:
    # Local configuration options go here (defaults are in /usr/share/logwatch/default.conf/logwatch.conf)
    I don't think there is an issue with the disk/inode limit. I ran the 'stat' command but to be honest didn't really know what I was looking for. If I run the '/usr/sbin/logwatch' command will it output errors to the terminal, or does it create a log file? Is there a error/log file that I can view that would outline what the error is?
    0
  • cPanelMichael
    The output of the 'cron.daily' command has almost 1400 lines - do you need all of it?

    This might be where the issue stems from. Here's the default version of this file:
    #!/bin/sh #Set logwatch location LOGWATCH_SCRIPT="/usr/sbin/logwatch" #Add options to this line. Most options should be defined in /etc/logwatch/conf/logwatch.conf, #but some are only for the nightly cronrun such as --output mail and should be set here. #Other options to consider might be "--format html" or "--encode base64", man logwatch for more details. OPTIONS="--output mail" #Call logwatch $LOGWATCH_SCRIPT $OPTIONS exit 0
    As you can see, it's much less than 1400 lines. You may want to uninstall and then reinstall the logwatch package on your system to revert it to the default settings:
    yum remove logwatch yum install logwatch
    Thank you.
    0
  • dancingpony
    Our version starts with the code below:
    #!/usr/bin/perl -w use strict; ########################################################################## # $Id: logwatch.pl,v 1.171 2006/03/24 23:16:55 kirk Exp $ ########################################################################## # Most current version can always be found at: # ftp://ftp.logwatch.org/pub/redhat/RPMS ######################################################## # Specify version and build-date: my $Version = '7.3'; my $VDate = '03/24/06'; ####################################################### # This was written and is maintained by: # Kirk Bauer # # Please send all comments, suggestions, bug reports, # etc, to logwatch@logwatch.org. # ########################################################
    So perhaps ours is just super old? I'll chat to our System Administrators and find out my options.
    0
  • cPanelMichael
    I'll chat to our System Administrators and find out my options.

    Hello, Let us know how it goes. Thank you.
    0
  • dancingpony
    We've recently migrated from CentOS 5 to CentOS 7 - and the since that time I haven't received anymore of these messages - plus the /var/cache/logwatch is non-existent - so I'm assuming there hasn't been an issue. I imagine this is due to the cron.daily file being updated.
    0

Please sign in to leave a comment.