Proper Logwatch Configuration using Ansible

On my way setting up a proper monitoring for my server, I just installed Logwatch to receive a daily summary of the what happened recently on the machine. I will have a look into Prometheus, Grafana, Icinga etc. later. However, for now I just wanted a quick summary of the daily “what’s going on on the machine”. Eventually, I had to fix an occur No such file or directory error.

Therefore, I decided to use Logwatch as a lightweight solution to my needs.

Installation Script

The Ansible script to install Logwatch is straight forward:

- name: Install logwatch
  apt:
    name: logwatch
    state: latest 
  tags:
    - logwatch

- name: Create logwatch.conf file for customisations
  file:
    path: /etc/logwatch/conf/logwatch.conf
    state: touch
  tags:
    - logwatch

- name: E-Mail to 
  lineinfile:
    dest: /etc/logwatch/conf/logwatch.conf
    regexp: "^MailTo ="
    line: "MailTo = {{ logwatch_email }}"
    state: present
  tags:
    - logwatch

- name: Set detail  
  lineinfile:
    dest: /etc/logwatch/conf/logwatch.conf
    regexp: "^Detail ="
    line: "Detail = {{ logwatch_detail }}"
    state: present
  tags:
    - logwatch

Configuration & Troubleshooting

I basically set up two parameters, the e-mail as well as the detail level I want for the report. Important to know is the order Logwatch is applying your configuration settings. Following the recommendations, I did not change anything in the configuration file at

/usr/share/logwatch/default.conf/logwatch.conf

rather I decided to copy the file to

/etc/logwatch/conf/

The reason is the order, logwatch is scanning for configuration parameters in the following order. Each step actually overwrites the previous one.

• /usr/share/logwatch/default.conf/*
• /etc/logwatch/conf/dist.conf/*
• /etc/logwatch/conf/*
• The script command line arguments

Eventually, I ended up in the following error:

/etc/cron.daily/00logwatch:
/var/cache/logwatch No such file or directory at /usr/sbin/logwatch line 634.
run-parts: /etc/cron.daily/00logwatch exited with return code 2

To fix this, avoid copying the original configuration to one of the other places. I did this because I followed some recommendation I received. Instead, I now touch a new configuration file as well as setting the two parameters for MailTo= as well as Detail=. Both are s set using Ansible variables in my scripts. The additional configuration file now looks pretty boring, though:

MailTo = mail@example.org
Detail = Low

You also can provide these parameters when calling the script in the cron job: Using Ansible the modification would look like the following:

lineinfile: 
  dest: /etc/cron.daily/00logwatch                
  regexp: "^/usr/sbin/logwatch"               
  line: "/usr/sbin/logwatch --output mail --mailto {{ logwatch_email }} --detail {{ logwath_detail }}"               
  state: present 
  create: yes

I decided to change the cron job call as one never can be safe from the file changing during package updates. The same should be valid for the configuration file at its origin place.

tl;dr

Setting up Logwatch using Ansible might cause strange “No file or directory”-errors during the cron job call. This can be avoided by applying additional configuration settings at appropriate configuration locations.