Get a daily report of your VPS every morning with Logwatch

Nobody reads a server's logs every day. Logwatch does it for you: every night it goes through the system logs and sends you a readable summary. SSH logins, service errors, disk space, addresses banned by Fail2ban, web server errors: two minutes of reading in the morning tell you whether anything unusual happened.

1. Why a daily report

Alerts, described in monitoring your VPS, warn you when a threshold is crossed. The daily report shows what does not trigger an alert but deserves your attention: a successful SSH login from an unexpected country, a service that restarts every night, PHP errors piling up, a disk slowly filling up.

2. Install Logwatch

apt update && apt install -y logwatch

Depending on your system, the installation may offer to install a mail server as well: if a Postfix configuration screen appears, choose No configuration for now. Sending email is covered in step 5.

3. Display a first report

Before configuring anything, display today's report in the terminal:

logwatch --detail med --range today --output stdout | less

The report is split by service: sshd, fail2ban, httpd for the web server, disk space, and so on. Only the services present on your server appear.

4. Configure the daily email

The installation already adds a daily job in /etc/cron.daily/00logwatch. You only need to tell it what to send and to whom. Create /etc/logwatch/conf/logwatch.conf:

Output = mail
Format = html
MailTo = [email protected]
MailFrom = [email protected]
Range = yesterday
Detail = Med
Service = All

• Range = yesterday: the report sent in the morning covers the whole previous day.
• Detail: Low for the essentials, Med for a good balance, High to see everything, which quickly becomes unreadable.
• Service: to remove a service that is too verbose, add a line such as Service = "-http" below Service = All.

5. Make sure the emails go out

Logwatch hands the email over to the system's mail program. You therefore need one, correctly configured, otherwise reports vanish or land in spam. The most reliable method for a server that only sends notifications is to relay email through an SMTP provider, as described in configuring Postfix for sending only.

Then test an immediate send:

logwatch --detail low --range today --output mail --mailto [email protected]

If nothing arrives, check the mail logs with journalctl -u 'postfix*' -n 30. A report that lands in the spam folder points to an authentication problem with the sender domain: see configuring SPF, DKIM and DMARC.

6. Read the report in two minutes

Focus on these sections, in this order:

1. sshd, successful logins: each line should match one of your own logins. A login you do not recognise is the most serious warning in the report.
2. Disk Space: usage of each partition. Above 80 %, clean up.
3. fail2ban: the number of banned addresses. A stable number is normal; a sudden explosion may come before a targeted attack.
4. Service errors: services that fail at startup or keep restarting.

Failed SSH login attempts often number in the hundreds: that is the background noise of the Internet. If passwords are disabled, they are harmless. See securing SSH.

7. Go further with journalctl

When the report flags something, trace it back to the source with the system journal:

journalctl -p err --since yesterday          # all errors since yesterday
journalctl -u nginx --since "2 hours ago"    # one specific service
journalctl --disk-usage                      # space used by the logs
journalctl --vacuum-time=30d                 # keep only 30 days

To limit the size of the logs permanently, add SystemMaxUse=500M to /etc/systemd/journald.conf, then restart the service with systemctl restart systemd-journald.

Frequently asked questions