Logwatch を CentOS にインストールする

Logwatch は、Apache や SSH などのログを見やすく整形した上で、メールで通知してくれる非常に便利なログ監視ツールです。

ログ監視をする上では、必須のツールといっていいでしょう。

Logwatch は以下のようにインストールします。

# yum -y install logwatch

インストールがうまく行ったかは、以下のコマンドで確認できます。

# logwatch --print

Logwatch から送られてくる内容のサンプルは以下のようになります。出力される内容は、Apache のエラーログ、SSH のログインのログ、メールの送受信ログ、ディスクの空き容量など様々ですね。

是非、活用しましょう。

 ################### Logwatch 7.3.6 (05/19/07) ####################
        Processing Initiated: Sun Jan 19 04:39:10 2014
        Date Range Processed: yesterday
                              ( 2014-Jan-18 )
                              Period is day.
      Detail Level of Output: 0
              Type of Output: unformatted
           Logfiles for Host: hostname
  ##################################################################

 --------------------- clam-update Begin ------------------------

 Last ClamAV update process started at Sat Jan 18 03:34:06 2014

 Last Status:
    WARNING: Your ClamAV installation is OUTDATED!
    WARNING: Local version: 0.98 Recommended version: 0.98.1
    DON'T PANIC! Read http://www.clamav.net/support/faq
    main.cvd is up to date (version: 55, sigs: 2424225, f-level: 60, builder: ne
o)
    Downloading daily-18360.cdiff [100%]
    Downloading daily-18361.cdiff [100%]
    Downloading daily-18362.cdiff [100%]
    Downloading daily-18363.cdiff [100%]
    daily.cld updated (version: 18363, sigs: 655489, f-level: 63, builder: neo)
    bytecode.cld is up to date (version: 235, sigs: 44, f-level: 63, builder: dg
oddard)
    Database updated (3079758 signatures) from db.jp.clamav.net (IP: 211.10.155.
48)

 ---------------------- clam-update End -------------------------

 --------------------- httpd Begin ------------------------

 Requests with error response codes
    403 Forbidden
       /wp-comments-post.php: 11 Time(s)
    404 Not Found
       /2013/02/28/291+%22%E8%BF%94%E4%BF%A1%E3%8 ... ~scheme&ct=clnk: 1 Time(s)
       /2013/03/02/images/stories/3xp.php: 2 Time(s)
       /2014/01/18/robots.txt: 3 Time(s)
       /2014/01/robots.txt: 3 Time(s)
       /2014/robots.txt: 3 Time(s)
       /?p=1511&preview=true: 1 Time(s)
       /?p=1532&preview=true: 1 Time(s)
       /?p=1590&preview=true: 1 Time(s)
       /?p=1596&preview=true: 1 Time(s)
       /?p=1607&preview=true: 1 Time(s)
       /?p=1613&preview=true: 1 Time(s)
       /?p=1647&preview=true: 1 Time(s)
       /?p=1661&preview=true: 1 Time(s)
       /?p=1670&preview=true: 1 Time(s)
       /?p=1675&preview=true: 2 Time(s)
       /?p=1680&preview=true: 1 Time(s)
       /apple-touch-icon-144x144-precomposed.png: 1 Time(s)
       /apple-touch-icon-144x144.png: 1 Time(s)
       /apple-touch-icon-152x152-precomposed.png: 1 Time(s)
       /apple-touch-icon-152x152.png: 1 Time(s)
       /apple-touch-icon-precomposed.png: 5 Time(s)
       /apple-touch-icon.png: 5 Time(s)
       /browserconfig.xml: 1 Time(s)
       /category/windows/page/2: 1 Time(s)
       /favicon.gif: 1 Time(s)
       /favicon.png: 1 Time(s)
       /images/stories/3xp.php: 2 Time(s)
       /linkex: 1 Time(s)
       /www.facebook.com/plugins/likebox.php?href ... amp;header=true: 9 Time(s)
    500 Internal Server Error
       /2014/01/12/1511?preview=true&preview_id=1 ... once=69b73f257b: 4 Time(s)
       /2014/01/13/1532?preview=true&preview_id=1 ... once=243d5fd60f: 4 Time(s)

 ---------------------- httpd End -------------------------

 --------------------- pam_unix Begin ------------------------

 su-l:
    Authentication Failures:
       xxx(500) -> root: 1 Time(s)
    Sessions Opened:
       xxx -> root: 3 Time(s)

 ---------------------- pam_unix End -------------------------

 --------------------- Postfix Begin ------------------------

   10.864K  Bytes accepted                            11,125
   10.864K  Bytes delivered                           11,125
 ========   ================================================

        5   Accepted                                 100.00%
 --------   ------------------------------------------------
        5   Total                                    100.00%
 ========   ================================================

        5   Removed from queue
        5   Delivered

 ---------------------- Postfix End -------------------------

 --------------------- SSHD Begin ------------------------

 Users logging in through sshd:
    xxx:
       xxx:xxx:xxx:xxx:xxx:xxx:xxx:xxx: 6 times

 Received disconnect:
    2: disconnected by server request : 4 Time(s)

 SFTP subsystem requests: 1 Time(s)

 ---------------------- SSHD End -------------------------

 --------------------- Disk Space Begin ------------------------

 Filesystem      Size  Used Avail Use% Mounted on
 /dev/vda3        97G  2.7G   89G   3% /
 /dev/vda1       243M  120M  111M  53% /boot

 ---------------------- Disk Space End -------------------------

 ###################### Logwatch End #########################