Using Logwatch for Basic Security Monitoring on Linux

Linux systems log a great deal of information. Each system service you install has its own log or logs, not just those generated by dmesg or the boot log. It is not uncommon to find thousands of entries in these files over a short period of time.

All this event logging is very useful for gathering insights into exactly what's going on in your computer (especially when a problem occurs), but the log files can grow to be very large and difficult to look through. Important warnings could be hidden in the log files. However, finding them among hundreds of entries can be difficult. It would be a time-consuming and manual task.

Logwatch relieves the system administrator of this burden by monitoring log files on your behalf. It will monitor the log files you specify and notify you by email when an entry requires your attention. Once we have configured Logwatch to our liking, it will automatically check for events we want to monitor. We no longer have to do this manually. The tutorial linked below will show you how to install and configure Logwatch on Linux systems.