SuSE

my-xftp0:~ # logwatch

 ################### Logwatch 7.4.0 (03/01/11) ####################
        Processing Initiated: Thu Nov 24 10:31:32 2011
        Date Range Processed: yesterday
                              ( 2011-Nov-23 )
                              Period is day.
        Detail Level of Output: 0
        Type of Output/Format: stdout / text
        Logfiles for Host: my-xftp0
  ##################################################################

 --------------------- SSHD Begin ------------------------

 Users logging in through sshd:
    priti:
       191.255.XXX.XXX(my-c0005.myhq.itelligence.com.my): 2 times
    root:
       191.255.XXX.XXX(my-c0005.myhq.itelligence.com.my): 2 times

 SFTP subsystem requests: 2 Time(s)

 ---------------------- SSHD End -------------------------


 --------------------- Syslog-ng Begin ------------------------


 Syslog-ng reloaded:                1 Time(s)

 ---------------------- Syslog-ng End -------------------------


 --------------------- Disk Space Begin ------------------------

 Filesystem            Size  Used Avail Use% Mounted on
 /dev/sda1              50G  413M   47G   1% /
 devtmpfs              1.9G  140K  1.9G   1% /dev
 /dev/sda2              10G  9.6M   10G   1% /boot/efi
 /dev/sda4              50G  184M   47G   1% /home
 /dev/sda7             9.9G  151M  9.2G   2% /opt
 /dev/sda8             9.9G  165M  9.2G   2% /tmp
 /dev/sda5             9.9G  2.5G  7.0G  26% /usr
 /dev/sda6             9.9G  250M  9.1G   3% /var


 ---------------------- Disk Space End -------------------------


 ###################### Logwatch End #########################

 --------------------- wmtp logs Begin ------------------------ 

 String found where operator expected at /etc/logwatch/scripts/services/my-report line 1, at end of line
        (Do you need to predeclare we?)
 Warning: Use of "log" without parentheses is ambiguous at /etc/logwatch/scripts/services/my-report line 1.
 syntax error at /etc/logwatch/scripts/services/my-report line 1, next token ???
 Search pattern not terminated at /etc/logwatch/scripts/services/my-report line 1.
 
 ---------------------- wmtp logs End -------------------------

my-mnag0:/etc/logwatch/scripts/services # ./my-report | more
Fri Dec 18 22:17:17 2009 Login    LOGIN              tty1                                               
Fri Dec 18 22:17:17 2009 Login    LOGIN              tty2                                               
Fri Dec 18 22:17:17 2009 Login    LOGIN              tty3                                               
Fri Dec 18 22:17:17 2009 Login    LOGIN              tty4                                               
Fri Dec 18 22:17:17 2009 Login    LOGIN              tty5                                               
Fri Dec 18 22:17:17 2009 Login    LOGIN              tty6       

...

my-mnag0:/etc/logwatch/scripts/services # more my-report
perl -we '@type=("Empty","Run Lvl","Boot","New Time","Old Time","Init","Login","Normal","Term","Account");$recs = ""; while (<>) {$r
ecs .= $_};foreach (split(/(.{384})/s,$recs)) {next if length($_) == 0;my ($type,$pid,$line,$inittab,$user,$host,$t1,$t2,$t3,$t4,$t5
) = $_ =~/(.{4})(.{4})(.{32})(.{4})(.{32})(.{256})(.{4})(.{4})(.{4})(.{4})(.{4})/s;if (defined $line && $line =~ /\w/) {$line =~ s/\
x00+//g;$host =~ s/\x00+//g;$user =~ s/\x00+//g;printf("%s %-8s %-12s %10s %-45s \n",scalar(gmtime(unpack("I4",$t3))),$type[unpack("
I4",$type)],$user,$line,$host)}}printf"\n"' < /var/log/wtmp
my-mnag0:/etc/logwatch/scripts/services #

1. Download the logwatch tar file from the internet. The latest running version is logwatch-7.4.0

2. Look here for the version-------------http://sourceforge.net/projects/logwatch/files/

3. Look here for developer details---http://logwatch.isoc.lu/tabs/docs/index.html

4. Download and store the tarball into your /tmp directory

5. Unzip, untar and cd into the folder

gunzip logwatch-7.4.0.tar.gz

untar -xvf logwatch-7.4.0.tar

cd logwatch-7.4.0

6. Create these directories and soft links:

mkdir /etc/logwatch
mkdir /etc/logwatch/scripts
mkdir /etc/logwatch/conf
mkdir /etc/logwatch/conf/logfiles
mkdir /etc/logwatch/conf/services
touch /etc/logwatch/conf/logwatch.conf
touch /etc/logwatch/conf/ignore.conf
touch /etc/logwatch/conf/override.conf

mkdir /usr/share/logwatch
mkdir /usr/share/logwatch/dist.conf
mkdir /usr/share/logwatch/dist.conf/logfiles
mkdir /usr/share/logwatch/dist.conf/services

mv conf/ /usr/share/logwatch/default.conf
mv scripts/ /usr/share/logwatch/scripts
mv lib /usr/share/logwatch/lib

mkdir /var/cache/logwatch
ln -s /usr/share/logwatch/scripts/logwatch.pl /etc/cron.daily/0logwatch
ln -s /usr/share/logwatch/scripts/logwatch.pl /usr/sbin/logwatch

7. Backup and edit the config file accordingly

 /usr/share/logwatch/default.conf/logwatch.conf

##to edit html format, edit these lines in the config file stated above

#Output/Format Options
#By default Logwatch will print to stdout in text with no encoding.
#To make email Default set Output = mail to save to file set Output = file
#Output = stdout
Output = mail
#To make Html the default formatting Format = html
Format = html

##to edit the email recipients, edit this line, separate multiple recipients with space

# Default person to mail reports to.  Can be a local account or a
# complete email address.  Variable Output should be set to mail, or
# --output mail should be passed on command line to enable mail feature.
MailTo = Priti.Patel@xxx.com.my onepatel@xxx.com

8. to add wtmp logs into monitoring you need to define 3 things: 

8.1  /usr/share/logwatch/scripts/services >>> this is where the script/work will be done

my-mnag0:/etc/logwatch/conf/logfiles # more /usr/share/logwatch/scripts/services/my-report
#!/usr/bin/perl
@type = (
    "Empty", "Run Lvl", "Boot", "New Time", "Old Time", "Init",
    "Login", "Normal",  "Term", "Account"
);
$recs = "";
while (<>) {
    $recs .= $_;
}
foreach ( split( /(.{384})/s, $recs ) ) {
    next if length($_) == 0 ;
    my ( $type, $pid, $line, $inittab, $user, $host, $t1, $t2, $t3, $t4, $t5 ) =
      $_ =~ /(.{4})(.{4})(.{32})(.{4})(.{32})(.{256})(.{4})(.{4})(.{4})(.{4})(.{4})/s;
    if ( defined $line && $line =~ /\w/ ) {
        $line =~ s/\
x00+//g;
        $host =~ s/\x00+//g;
        $user =~ s/\x00+//g;
        printf(
            "%s %-8s %-12s %10s %-45s \n",
            scalar( gmtime( unpack( "I4", $t3 ) ) ),
            $type[
              unpack( "
I4", $type )
            ],
            $user,
            $line,
            $host
        );
    }
}
printf "\n" 

8.2  /usr/share/logwatch/default.conf/services >>> this is where you define the services/config options of your script above

my-mnag0:/etc/logwatch/conf/logfiles # more /usr/share/logwatch/default.conf/services/my-report.conf
Title = "WTMP logs"
Logfile = wtmp

8.3  /etc/logwatch/conf/logfiles >>> this is where the log files will be parsed

my-mnag0:/etc/logwatch/conf/logfiles # more /etc/logwatch/conf/logfiles/wtmp.conf
#Define log file group for wtmp log

Logfile = /var/log/wtmp

The reason the wtmp and wtmp.conf is in red is because both names must be same. different names will call different logs/generate error