Master Logwatch: Install and Automate Linux Log Analysis on CentOS

Log files are critical system resources, and manually reviewing them daily is tedious and error‑prone; a log analysis tool can automate this task and email concise reports to the root user.

Installing Logwatch on CentOS

Logwatch is not installed by default on the "Basic Server" profile, so install it manually: yum -y install logwatch After installation, copy the default configuration file to the active location:

cp /usr/share/logwatch/default.conf/logwatch.conf /etc/logwatch/conf/logwatch.conf

Edit /etc/logwatch/conf/logwatch.conf to set the main options (most lines are comments and can be removed). A typical minimal configuration looks like:

LogDir   = /var/log
TmpDir   = /var/cache/logwatch
MailTo   = root
MailFrom = Logwatch
Print    =
Range    = yesterday
Detail   = Low
Service  = All
Service  = "-zz-network"
Service  = "-zz-sys"
Service  = "-eximstats"

The file usually requires no further changes; Logwatch runs daily via a cron job placed in /etc/cron.daily/0logwatch by the package.

Running Logwatch Manually

To trigger an immediate analysis, execute: logwatch The command generates an email with sections such as:

Connections (secure‑log) : new users, groups, failed logins.

SSHD : login counts per IP, SFTP requests.

Yum : list of installed packages.

Disk Space : filesystem usage summary.

Sample output excerpts illustrate how Logwatch reports new users, groups, failed root logins, SSH connection counts, installed packages, and disk usage percentages.

Conclusion

Using Logwatch dramatically simplifies log management, allowing administrators to focus on higher‑priority tasks while receiving daily summaries of system activity. Although many other log analysis tools exist, Logwatch provides a lightweight, ready‑to‑use solution for CentOS environments.