logwatchを導入し、日次でログ内容をメールで受信する。
OS
# uname -a
FreeBSD www.server-bff.net 12.3-RELEASE FreeBSD 12.3-RELEASE r371126 GENERIC amd64
稼働サービス
# httpd -v
Server version: Apache/2.4.53 (FreeBSD)# named -v
BIND 9.16.27 (Extended Support Version) <id:96094c5>
logwatchインストール
# pkg install logwatch-7.5.1
Updating FreeBSD repository catalogue...
FreeBSD repository is up to date.
All repositories are up to date.
The following 1 package(s) will be affected (of 0 checked):
New packages to be INSTALLED:
logwatch: 7.5.1
Number of packages to be installed: 1
The process will require 2 MiB more space.
298 KiB to be downloaded.
Proceed with this action? [y/N]: y
[1/1] Fetching logwatch-7.5.1.pkg: 100% 298 KiB 305.5kB/s 00:01
Checking integrity... done (0 conflicting)
[1/1] Installing logwatch-7.5.1...
[1/1] Extracting logwatch-7.5.1: 100%
設定ファイルは、ここ
/usr/local/etc/logwatch/defaults/logwatch.conf
logwatch.confの設定箇所抜粋
########################################################
# This was written and is maintained by:
# Kirk Bauer <このメールアドレスはスパムボットから保護されています。閲覧するにはJavaScriptを有効にする必要があります。 >
#
# Please send all comments, suggestions, bug reports,
# etc, to このメールアドレスはスパムボットから保護されています。閲覧するにはJavaScriptを有効にする必要があります。 .
#
########################################################
# NOTE:
# All these options are the defaults if you run logwatch with no
# command-line arguments. You can override all of these on the
# command-line.
# You can put comments anywhere you want to. They are effective for the
# rest of the line.
# this is in the format of <name> = <value>. Whitespace at the beginning
# and end of the lines is removed. Whitespace before and after the = sign
# is removed. Everything is case *insensitive*.
# Yes = True = On = 1
# No = False = Off = 0
# Default Log Directory
# All log-files are assumed to be given relative to this directory.
LogDir = /var/log
# You can override the default temp directory (/tmp) here
TmpDir = /usr/local/var/logwatch
#Output/Format Options
#By default Logwatch will print to stdout in text with no encoding.
#To make email Default set Output = mail to save to file set Output = file
Output = stdout
#To make Html the default formatting Format = html
Format = text
#To make Base64 [aka uuencode] Encode = base64
Encode = none
# Input Encoding
# Logwatch assumes that the input is in UTF-8 encoding. Defining CharEncoding
# will use iconv to convert text to the UTF-8 encoding. Set CharEncoding
# to an empty string to use the default current locale. If set to a valid
# encoding, the input characters are converted to UTF-8, discarding any
# illegal characters. Valid encodings are as used by the iconv program,
# and `iconv -l` lists valid character set encodings.
# Setting CharEncoding to UTF-8 simply discards illegal UTF-8 characters.
#CharEncoding = ""
# Default person to mail reports to. Can be a local account or a
# complete email address. Variable Output should be set to mail, or
# --output mail should be passed on command line to enable mail feature.
MailTo = このメールアドレスはスパムボットから保護されています。閲覧するにはJavaScriptを有効にする必要があります。 ←メールの送信先アドレスを記載
# WHen using option --multiemail, it is possible to specify a different
# email recipient per host processed. For example, to send the report
# for hostname host1 to このメールアドレスはスパムボットから保護されています。閲覧するにはJavaScriptを有効にする必要があります。 , use:
#Mailto_host1 = このメールアドレスはスパムボットから保護されています。閲覧するにはJavaScriptを有効にする必要があります。
# Multiple recipients can be specified by separating them with a space.
# Default person to mail reports from. Can be a local account or a
# complete email address.
MailFrom = Logwatch
# The default time range for the report...
# The current choices are All, Today, Yesterday
Range = yesterday
# The default detail level for the report.
# This can either be Low, Med, High or a number.
# Low = 0
# Med = 5
# High = 10
Detail = High
cronでの定期実行設定
# vi /etc/crontab
# /etc/crontab - root's crontab for FreeBSD
#
# $FreeBSD: releng/12.3/usr.sbin/cron/cron/crontab 338497 2018-09-06 14:55:54Z brd $
#
0 5 * * * root /usr/local/sbin/logwatch.pl --output mail
毎朝、5時にログの集計結果をメールで受信する。
こんな感じ
↓
件名：Logwatch for www.server-bff.net (FreeBSD)
本文
################### Logwatch 7.5.1 (01/22/19) ####################
Processing Initiated: Sun Jun 5 05:00:02 2022
Date Range Processed: yesterday
( 2022-Jun-04 )
Period is day.
Detail Level of Output: 10
Type of Output/Format: mail / text
Logfiles for Host: www.server-bff.net
##################################################################
--------------------- Cron Begin ------------------------
Commands Run:
User operator:＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊
---------------------- Cron End -------------------------
--------------------- Kernel Begin ------------------------
5 Time(s): arp: 192.168.XXX.XXX moved from XXXXXXX on vtnet0
---------------------- Kernel End -------------------------
--------------------- Named Begin ------------------------
**Unmatched Entries**
DNS format error from XXX.XXX.XXX.XXX#53 resolving XXXX.com/AAAA for <unknown>: XXXX (SOA) not subdomain of zone XXX.com -- invalid response: 5 Time(s)
---------------------- Named End -------------------------
--------------------- SpamAssassin Begin ------------------------
**Unmatched Entries**
XXXXXX failed: 1: 3 Time(s)
---------------------- SpamAssassin End -------------------------
--------------------- Disk Space Begin ------------------------
Filesystem Size Used Avail Capacity Mounted on
/dev/vtbd0p2 XXXG XXG XXXG X% /
devfs XXK XXK XB XX% /dev
---------------------- Disk Space End -------------------------
###################### Logwatch End #########################
以上