On CentOS5 with the latest updates applied, the logwatch filter for postfix returns way too many lines from the log. I get an "unmatched entries" message and all messages that have gone through the system is listed.
Here is an example:
8F930A8092: to=morten@foo.bar, orig_to=morten@localhost, relay=local, delay=0.19, delays=0.06/0.01/0/0.12, dsn=2.0.0, status=sent (delivered to command: /usr/bin/procmail)
I have tried to look at the logwatch config and some google hits on similar problems but on debian. The hints there does not match what is relevant for CentOS.
Anyone seen this problem on CentOS or is it some specific problem to my configuration? I use fetchmail/postfix/dovecot/procmail locally on the server to consolidate mail. Could be that it tries to filter on some hostname/domain name?