Master Logwatch: Install and Automate Linux Log Analysis on CentOS

Linux Log Analysis Tool (Logwatch) Installation and Usage

System logs are crucial for monitoring server health, but manually reviewing them is tedious. Log analysis tools like Logwatch automate this process by parsing logs and emailing summaries to the root user.

CentOS includes Logwatch, but it is not installed by default in the “Basic Server” profile. Install it with: yum -y install logwatch After installation, create the configuration file by copying the default template:

cp /usr/share/logwatch/default.conf/logwatch.conf /etc/logwatch/conf/logwatch.conf

Edit /etc/logwatch/conf/logwatch.conf to set parameters such as:

LogDir = /var/log
TmpDir = /var/cache/logwatch
MailTo = root
MailFrom = Logwatch
Print = 
Range = yesterday
Detail = Low
Service = All
Service = "-zz-network"
Service = "-zz-sys"
Service = "-eximstats"

The default configuration runs daily via a cron job placed in /etc/cron.daily/0logwatch. To run Logwatch immediately, execute: logwatch The command generates an email containing sections such as secure‑log analysis, SSHD connections, installed packages, and disk usage, providing a concise overview of system activity.

Using Logwatch greatly simplifies log management; other Linux distributions also offer alternative log analysis tools.