logwatch question
Bonjour, Today, I get this warning from logwatch: gzip: stdout: No space left on device system 'zcat '/var/log/syslog.2.gz' >> /tmp/logwatch.X_4YucXv/syslog-archive' failed: 256 at /usr/sbin/logwatch line 774. run-parts: /etc/cron.daily/00logwatch exited with return code 2 Upto now there were no problems to run logwatch. I understand that my /tmp partition is too small, but I don't understand why logwatch needs more than 1 Gb to write the log digest? I installed /tmp as tmpfs, is there a config file for logwatch where I can modify this and tell logwatch to use /var/tmp instead of /tmp? Thank you -- François Patte UFR de mathématiques et informatique Laboratoire CNRS MAP5, UMR 8145 Université Paris Descartes 45, rue des Saints Pères F-75270 Paris Cedex 06 Tél. +33 (0)1 8394 5849 http://www.math-info.univ-paris5.fr/~patte signature.asc Description: OpenPGP digital signature
Re: logwatch question
François Patte wrote: > I installed /tmp as tmpfs, is there a config file for logwatch where I > can modify this and tell logwatch to use /var/tmp instead of /tmp? The default value in the program can be (and is) overridden by the system installed default configuration file logwatch.conf, which may be found in /usr/share/logwatch/default.conf/ and /usr/share/logwatch/dist.conf/ Fortunately you can create your own /etc/logwatch/conf/logwatch.conf and re-override these values. Look for the TmpDir keyword. Read "Customizing the Configuration" in the documentation file /usr/share/doc/logwatch/HOWTO-Customize-LogWatch.gz for the precise details. Chris -- To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/q48njaxo18@news.roaima.co.uk
Re: logwatch question
François Patte wrote: > Today, I get this warning from logwatch: I am glad there was a good answer to your question. And now that there has been one I feel okay in posting something taking this in a different direction. I suggest that you don't try to "make a silk purse out of a pigs ear". The logwatch package has always been a little rough. In Debian the much more supported tool is logcheck. I find it superior to logwatch in many ways. If you have not heard of logcheck then please check it out. $ apt-cache show logcheck Description-en: mails anomalies in the system logfiles to the administrator Logcheck helps spot problems and security violations in your logfiles automatically and will send the results to you in e-mail. . Logcheck was part of the Abacus Project of security tools, but this version has been rewritten. Homepage: http://www.logcheck.org/ I suggest trying logcheck and removing logwatch. > I understand that my /tmp partition is too small, but I don't understand > why logwatch needs more than 1 Gb to write the log digest? Who can know what evil lurks in the hearts of men? But I assume this is simply a rhetorical question. But it is one of the reasons to move away from the tool. Unless you want to become involved in the upstream and work to fix it. Bob signature.asc Description: Digital signature
