We use cookies to ensure that we give you the best experience on our website.  Visit our Privacy Policy to learn more. If you continue to use this site, we will assume that you are okay with it.

Your choices regarding cookies on this site.
Your preferences have been updated.
In order for the changes to take effect completely please clear your browser cookies and cache. Then reload the page.

Check manual page of logwatch

Checkmk Manual

On this page

Search in the manual

Check Logfiles for Relevant New Messages

Distribution: official part of Check_MK
License: GPL
Supported Agents: Linux, Windows, AIX, Solaris

This check processes the output of agents with the logwatch plugin. The windows agent has built in this extension. The logwatch extension of the Linux/UNIX agents needs a configuration file that lists all relevant logfiles and lists possible log lines that should result in warning or critical state. The windows agents does not need any configuration but sends all log files in the Windows event log. It uses the warning/error classification of Windows.

Relevant log messages found by the agent are stored locally into a text file. The check is critical, if at least one new or old log message exists that is classified as critical. If at least one warning message exists but no critical, the check results in a warning state.

The only way to bring the state back to OK is to delete the text file with the stored log messages. This is stored below ~/var/check_mk/logwatch. Usually the logwatch webpage is used to browse and delete the messages. Please refer to the online documentation of check_mk for more details about logwatch.


The name of the logfile. For Linux/UNIX this is the complete absolute path name of the logfile. For Windows this is the name as shown in the windows event log, for example Application (case sensitive!).


One service is created for each logfile when the option logwatch_forward_to_ec is not configured or set to False. Please use standard inventory configuration methods if you want to ignore certain log files.