Maintaining security and stability on production Ubuntu servers requires consistent log monitoring. Over days of standard operation, Linux system daemons generate tens of thousands of lines of log data across /var/log/auth.log, /var/log/syslog, web server access records, and firewall packet drop tables. Manually sifting through massive plain-text log files using grep or tail is time-consuming and inevitably leads to overlooked authentication anomalies or service degradation warnings.
The Logwatch utility provides an automated, customizable log parsing engine for Linux systems. Operating via scheduled cron jobs, Logwatch analyses accumulated system logs across specified intervals, filters routine daemon noise, extracts critical security milestones—such as failed SSH brute-force attempts, sudo command executions, disk space warnings, and package updates—and compiles clean, formatted diagnostic summaries dispatched directly to administrative email addresses.
Installing Logwatch on Ubuntu Server
Logwatch is available in the standard Ubuntu software archives and can be installed alongside a local mail transfer agent:
- Update the local APT package index:
sudo apt update- Install Logwatch and standard mail delivery utilities:
sudo apt install -y logwatch postfix mailutilsDuring the Postfix package configuration dialogue, select Internet Site if your server sends mail directly, or Satellite system if relaying through an external SMTP provider.
Configuring Logwatch Parameters and Report Detail Levels
Rather than editing default package files in /usr/share/logwatch/, create a local override configuration inside /etc/logwatch/:
- Copy the master configuration template to the administrative directory:
sudo cp /usr/share/logwatch/default.conf/logwatch.conf /etc/logwatch/conf/- Open the local configuration file for editing:
sudo nano /etc/logwatch/conf/logwatch.conf- Customise the primary operational parameters:
# Specify recipient administrative email
MailTo = [email protected]
# Specify the sender email address
MailFrom = [email protected]
# Detail level: Low (0), Med (5), or High (10)
Detail = Med
# Time range to analyse: Yesterday, Today, or All
Range = Yesterday
# Format: text or html
Format = html- Save the file and exit the editor (
Ctrl + O, thenCtrl + X).
Testing Logwatch and Automating Execution via Cron
Before relying on automated background schedules, execute a manual diagnostic run:
- Run Logwatch and output the formatted report directly to standard console output:
sudo logwatch --range Yesterday --detail Low --output stdout- To dispatch an immediate test report to your configured administrative email:
sudo logwatch --mailto [email protected] --detail MedUpon installation, Ubuntu automatically places an execution script in /etc/cron.daily/00logwatch. Every morning, cron executes Logwatch, inspects yesterday’s system logs, and delivers a consolidated security summary, ensuring proactive infrastructure oversight without manual log parsing.