Logwatch solves a problem that otherwise goes unsolved: it reads all of the server's logs for you and sends a digest of the past day. Nobody goes through auth.log and the web server logs daily, whereas reading one email in the morning is achievable.

The known problem: the first message arrives with several hundred lines, the second is skimmed, a week later a mail rule sends them to a separate folder, and that is the end of the watching. The cause is almost always the default settings, and it takes ten minutes to fix.

Installation and where to change settings

sudo apt install logwatch

Where you put your values matters. The file /usr/share/logwatch/default.conf/logwatch.conf must not be touched — it is overwritten when the package updates. Your file is /etc/logwatch/conf/logwatch.conf. It may be empty; it is enough to add only what you are changing.

Output = mail
Format = html
MailTo = admin@example.com
Detail = Low
Range = yesterday

The detail level decides everything

Detail takes values from 0 to 10 or the words Low, Med, High. The difference is enormous: at High the report includes every connection and every request; at Low only totals and anomalies.

The practice is this: Low overall, with detail raised selectively for the services you actually care about. Per-service settings go into /etc/logwatch/conf/services/ — for example a file sshd.conf containing the line Detail = High.

A benchmark for checking: the report should fit on a screen or a screen and a half. Anything longer will stop being read — not out of laziness but because a deviation is invisible among three hundred lines of routine.

To see the result without waiting for the morning:

sudo logwatch --detail Low --range today --output stdout

An empty SSH section on Debian 12

A separate trap on recent systems. Logwatch reads text files in /var/log, and Debian 12 and Ubuntu 24.04 no longer install rsyslog by default — the file /var/log/auth.log simply does not exist, and everything goes to the systemd journal. The report still arrives faithfully, but the section that matters most — SSH logins — comes out empty or missing.

Checking takes a second:

ls -l /var/log/auth.log

No file means either installing rsyslog or accepting that Logwatch on this machine shows an incomplete picture. An empty section is easy to read as "nothing happened", and that is the most dangerous consequence.

Where the mail goes

The second common cause of "the reports do not arrive": the server has no mail delivery configured. Logwatch hands the message to the system agent, which sends it nowhere, and it settles in root's local mailbox where nobody ever looks:

sudo cat /var/mail/root | tail -50

There are two options. Either configure delivery through an external SMTP relay, or do not use mail at all and write the report to a file:

Output = file
Filename = /var/log/logwatch/report.txt

The second is the more honest one: an email nobody can deliver creates an illusion of watching, whereas a file on disk can at least be opened.

What to read in the report

In descending order of usefulness:

  • sshd. Successful logins — who, and from where. Successful ones specifically, not the thousands of failures: failures are background, whereas a login from an unfamiliar address needs explaining;
  • sudo and pam_unix. Who escalated privileges and who created users;
  • Disk Space. One line that warns about a filling disk in advance;
  • cron. Jobs that appeared and jobs that failed;
  • http. A spike in 404 responses usually means path probing; a spike in 500s means something of yours broke;
  • postfix, if the server sends mail: a growing outbound queue is the typical sign that the server has been put to use as a spam relay.

The limits of it

Logwatch is a digest of the past day, not an alert. It will not wake you at night and by definition lags behind: it runs from a daily job in the early hours and covers yesterday. For "something is happening right now" it is neither suitable nor intended.

Its strength is elsewhere — it shows you the shape of an ordinary day. After a month of reading you know how many failed logins you normally get, how many requests the site takes and how much mail goes out; and when one of those figures doubles, it is visible at once, with no thresholds and no rules involved. Which is why the report is worth keeping where it will catch your eye rather than in a mail folder. What that looks like on a page is on the demo below.