*This is actually on Rocky Linux / CENTOS / RHEL, but will likely work on others.

Logwatch can be a nice tool for keeping an eye on your servers. It goes through your logs and creates a nightly aggregate email containing information to keep you apprised of various important details. It can be good to bring things to the attention of lazy / overwhelmed sysadmins like me.

Where it fails, though, is where it overwhelms you with useless information. There are different output level settings, and if you turn the detail levels down far enough, it helps a lot. However, with certain configs and certain OSes, you still get overwhelmed with non-actionable information. Here’s how to fix a few of those.

Crontabs. In Rocky Linux, cron logs a success message that contains a process number, which means the default log is filled with lots and lots of lines like session-685197.scope: Succeeded.: 1 Time(s) which logwatch happily throws into the nightly email. Most searches tell you to edit your /etc/logwatch/conf/ignore.conf file and add the following line:

session-.*scope: Succeeded

This doesn’t work for me. Further research indicates that the ignore.conf file wants a Perl-style regular expression. The recommendation above is sort-of-Perlish, but what ended up working correctly for me was putting the following line in my ignore.conf:

\s*session-(.*?)\.scope: Succeeded\.(.*)

HTTP. For some reason, someone thought having a long list of hostile IP addresses would be helpful. Maybe to manually block them? Seems like a hopeless task. Check out /usr/share/logwatch/scripts/services/http around line 596… and un-comment out the conditional.

$flag = 1;
foreach my $i (sort keys %ban_ip) {
   if ($flag) {
      print "\nA total of ".scalar(keys %ban_ip)." sites probed the server \n";
      $flag = 0;
   }
   #if ($detail > 4) {
      print "   $i\n";
   #}
} 

sshd. I know there are a lot of hackers, script kiddies, and bots out there. I don’t need to see the long list of people who tried and failed to log in with ssh. Unfortunately, the detail level setting for sshd aren’t very helpful. I ended up editing /usr/share/logwatch/scripts/services/sshd and liberally sprinkling my own if ($Detail > 4) { … } barriers starting around line 500. Hacky, I know. Also will be clobbered with the next logwatch update. Yuck.

Maybe it’s time for me to submit a bunch of pull requests.

Went to update an image gallery with some new pictures. I wrote the gallery generating code four years ago, but the version of PHP on the server has been updated and one of the libraries I use evidently relies on deprecated syntax ($string{$char_index} for the curious, which now would be $string[$char_index]). So I tried to check out the repo from GitHub, only to find they’ve updated their SSH host keys, so I need to fix that before I can fix the code problem. So I tried to update that, but had packed my Yubikey off in a drawer in the office…

Going through my old scribbled notes, I came across these from 1994:

A limerick writer I’m not,
for rhyming no talent I’ve got.
I know to count feet
or syllabic beat,
but how many lines I’ve forgot.

The limericks that Tina once wrote
with one affliction were smote:
They ended so fine,
on next to last line

A poet there was from Bombay,
whose limericks were strange in one way:
three lines they’d have

There is a young gal from Purdue,
whose limericks all end at line two.

There once was a man from Verdun,

(and then I seem to recall there’s a limerick about a guy named Nero…)