logo logo
jan 30

Logwatch mail showing no iptables entries in Ubuntu/Mint

I use logwatch to send me an email every day from a few servers I maintain at home (for monitoring websites of my clients for instance with Zabbix and Nagios). I have a few Raspberry Pi's and a few Linux Mint servers which have logwatch set up.

After I recently hardened all servers with UFW, I got iptables output from the Raspberry Pi's, but not from the Linux Mint servers. After walking through all settings of both UWF and Logwatch I finally found the culprit, hope this may help you.

It seems that on Raspian, the OS on the Raspberries, /var/log/messages still exists. On Ubuntu and Linux Mint, messages does not exist anymore, a long time ago already. But the Logwatch (version 7.4.3) provided in the OS repository provides a configuration of iptables which uses /var/log/messages for getting it's IP tables information. Instead syslog should be used, available in all Debian derivates.

This is where you can find the iptables configuration for logwatch:

/usr/share/logwatch/default.conf/services/iptables.conf

With

less /usr/share/logwatch/default.conf/services/iptables.conf

you can see this:

# Which logfile group...
LogFile = messages
LogFile = iptables

With messages is meant: /var/log/messages

Now don't go changing this file, because an update on Logwatch will overwrite your changes. You have to make an override which will stay there even with an update of Logwatch:

sudo cp /usr/share/logwatch/default.conf/services/iptables.conf /etc/logwatch/conf/services/

 And then you make your changes to the latter with (using vim here, use your favorite editor):

sudo vim /etc/logwatch/conf/services/iptables.conf

and change the LogFile = messages to LogFile = syslog:

Which logfile group...
LogFile = syslog
LogFile = iptables

Save your changes.

You can test the output just by using the logwatch command:

logwatch