On 04/09/2017 09:42 AM, Richard wrote:

...

Date: Sunday, April 09, 2017 08:36:17 -0400 From: Robert Moskowitz rgm@htt-consult.com

Logwatch is installed, and I am assuming by how empty /etc/logwatch is that it is running from defaults, which I find in /usr/share/logwatch/default.conf/services

I want to customize ONE service. dovecot.

Do I copy /usr/share/logwatch/default.conf/services/dovecot.conf

to

/etc/logwatch/conf/services

and edit it there,

or do I have to copy ALL default.conf/services/* there and modify /etc/logwatch/conf/logwatch.conf to look there?

The README is rather not helpful on this.

How do I modify ONE service (and not just make the changes in default.conf that I have seen in a couple howtos.

I think that the HOWTO, referenced in the logwatch man page, has a fairly complete explanation of approaches to customization.

centos-6/logwatch-7.3.6

MORE INFORMATION
  The directory /usr/share/doc/logwatch-* contains several
  files with additional documentation:
    HOWTO-Customize-LogWatch
      Documents the directory structure of Logwatch
      configuration and executable files,  and describes how
      to customize Logwatch by overriding these default files.

thanks. I think I got it from the sendmail example.

" For example, if file /etc/logwatch/conf/services/sendmail.conf has the single entry: $sendmail_unknownusersthreshold = 5 then the threshold for unknown users is set to five instead of the default of one. All other parameters are not modified. "

thus:

cat > /etc/logwatch/conf/services/dovecot.conf # Override the default Detail level. This will only affect dovecot's report. $dovecot_detail = 10

I will see how it goes after tonight!