Well, I tried to find a howto on parsing NGINX with logwatch, but I found content lacking. So I decided to create my own. There is a small caveat, this is for the CentOS RPM install of NGINX; your files may reside in different places.

1. copy the logfile conf for httpd to nginx located in /usr/share/logwatch/default.conf/logfiles/

# cp httpd.conf nginx.conf

2. Modify the nginx.conf file to use the files in /var/log/nginx (Note: logwatch already knows /var/log/ as the LogPath). You can modify the conf file to look as such:

########################################################
# Define log file group for nginx
########################################################

# What actual file? Defaults to LogPath if not absolute path….
LogFile = nginx/*access.log

# If the archives are searched, here is one or more line
# (optionally containing wildcards) that tell where they are…
#If you use a “-” in naming add that as well -mgt
Archive = nginx/*access.log*

# Expand the repeats (actually just removes them now)
*ExpandRepeats

# Keep only the lines in the proper date range…
*ApplyhttpDate

# vi: shiftwidth=3 tabstop=3 et

3, copy the services conf for httpd to nginx located in /usr/share/logwatch/default.conf/services/

# cp http.conf nginx.conf

4. Modify the nginx.conf so that the head of the file looks like such:

###########################################################################
# Configuration file for nginx filter
###########################################################################

Title = “nginx”

# Which logfile group…
LogFile = nginx

5. copy service file for http to nginx located in /usr/share/logwatch/scripts/services

# cp http nginx

6. Run Logwatch

# /usr/sbin/logwatch

4 Responses to “Howto Configure Logwatch to Parse NGINX”
  1. IchBin says:

    Found this post in google. Thank you for this. Logwatch works great with my nginx now thanks to you.

  2. Stan Brown says:

    Thanks IchBin, I’m glad my article was useful. I am now motivated to write more, so thanks to you also.

  3. Mike says:

    Awesome. Works like a charm. Thanks!

  4. I found this article through Google too. I found similar links for the same, but none explained as clearly as this. So, I request you to write more too.

    Thanks.

  5.  
Leave a Reply