Logcheck output redirect

[singlespeed]

Does anyone know if it's possible to redirect the email from logcheck to an outside address and not the default of root@localhost? I have a system I'm deploying remotely and I'd like to have it email me the logcheck reports instead of me having to ssh to the machine and read root mail.

thanks,

[mdwatts]

Could you not just modify the logcheck config and change root@localhost to singlespeed@microsoft.com ?

:D

[singlespeed]

MD, that was mean to hurt (singlespeed@microsoft.com!!!).... :(

actually logcheck 1.1.1 doesn't have a config file that (I know of). it's all self contained. I looked at the website listed at rpmfind.net for logcheck to confirm.

Then I realized on my RH8.0 box logcheck v. 2.somthin is running which DOES have a config script. I'll search the RPMs on the RH 7.3 disc's to see if they have a logcheck on them with a higher version. :P

Scratch that, it's "Logwatch 2.6" not logcheck

anyway, they do the same thing....

[mdwatts]

You can add a email address to i.e. /etc/logrotate.d/syslog for the different sections.


/var/log/messages {
daily
rotate 5
compress
mail user@domain.com
errors user@domain.com
size=200k
postrotate
/usr/bin/killall -HUP syslogd
endscript
}


From the logrotate manpage.


mail address
When a log is rotated out-of-existence, it is mailed to address. If no mail
should be generated by a particular log, the nomail directive may be used.

[singlespeed]

wouldn't that give me the whole log section instead of just the "interesting" stuff that logwatch filters out for me?

btw, removed logcheck 1.1.1-1 and installed logwatch 2.6-8. All works well now. :D