Configure Logwatch Email Reports on Ubuntu VPS: Complete Setup

Understanding Logwatch for VPS System Monitoring

Logwatch creates automated daily reports from your Ubuntu VPS system logs. You get comprehensive email summaries covering security events, disk usage, service status, and potential issues. This monitoring approach helps hosting customers catch problems before they impact websites or email services.

The tool analyzes standard Linux log files including auth.log, syslog, and mail.log. You'll get organized reports highlighting failed login attempts, disk space warnings, and unusual system activity.

Perfect for Hostperl VPS customers who want proactive system monitoring without constant SSH access. Most control panels like cPanel handle basic monitoring, but Logwatch provides deeper system-level insights that complement your hosting dashboard.

Installing Logwatch on Your Ubuntu VPS

Start by updating your package repositories and installing Logwatch along with required dependencies:

sudo apt update
sudo apt install logwatch mailutils postfix

During installation, Postfix configuration will appear. Choose "Internet Site" for most hosting scenarios.

Enter your server's fully qualified domain name when prompted. This ensures proper email delivery from your VPS.

Verify the installation completed successfully:

logwatch --version
which logwatch

The system should display version information and the installation path at /usr/sbin/logwatch.

Configure Logwatch Email Reports Settings

Edit the main configuration file to set your email address and report preferences:

sudo nano /usr/share/logwatch/default.conf/logwatch.conf

Locate and modify these key settings:

# Email address to receive reports
MailTo = your-email@yourdomain.com

# From address (use your server's domain)
MailFrom = logwatch@yourserver.com

# Detail level: Low, Med, High, or numeric (0-10)
Detail = Med

# Time range for reports
Range = yesterday

# Output format
Output = mail

The Detail setting controls report verbosity. Start with "Med" for balanced information.

"High" provides extensive details but can overwhelm new users. "Low" offers basic summaries suitable for busy administrators.

Customizing Report Content and Services

Create a custom configuration file to override defaults without modifying system files:

sudo mkdir -p /etc/logwatch/conf
sudo nano /etc/logwatch/conf/logwatch.conf

Add your specific customizations:

# Custom settings override defaults
MailTo = admin@yourcompany.com
Detail = High

# Include specific services
Service = All
# Or select specific services:
# Service = sshd
# Service = postfix
# Service = http

# Exclude services you don't need
Service = "-zz-network"
Service = "-zz-sys"

Service names correspond to log analysis scripts in /usr/share/logwatch/scripts/services/. List available services:

ls /usr/share/logwatch/scripts/services/

Common services for hosting environments include sshd (SSH access), postfix (mail server), http (Apache), and dpkg (package management).

Exclude irrelevant services to focus reports on hosting-critical components.

Test Email Delivery and Report Generation

Generate a test report to verify configuration and email delivery:

sudo logwatch --detail Med --mailto your-email@domain.com --range yesterday

Check the mail queue if emails don't arrive promptly:

mailq
sudo systemctl status postfix

Review Postfix logs for delivery issues:

sudo tail -f /var/log/mail.log

Common email delivery problems include firewall restrictions on port 25, DNS resolution issues, or spam filters blocking server emails. Configure your server's hostname and reverse DNS properly to improve deliverability.

If using external SMTP for outbound email, configure Postfix as a relay. This approach works well with business email services or when your VPS IP has delivery restrictions.

Schedule Automated Daily Reports

Logwatch automatically installs a cron job for daily reports. Verify the scheduled task exists:

cat /etc/cron.daily/00logwatch

The default script runs Logwatch with system configuration settings. To customize the scheduled run, edit the cron script or create your own:

sudo nano /etc/cron.daily/00logwatch

Modify the execution line to match your preferences:

#!/bin/bash
/usr/sbin/logwatch --output mail --format html --mailto admin@yourcompany.com

For custom scheduling beyond daily runs, add a crontab entry:

sudo crontab -e

Add weekly reports every Monday at 7 AM:

0 7 * * 1 /usr/sbin/logwatch --range 'between -7 days and yesterday' --detail High --mailto admin@company.com

Monitor Email Performance and Log Analysis

For hosting customers running email services, Logwatch provides detailed mail server analysis. The postfix service report shows delivery statistics, bounce rates, and authentication failures.

Enable additional mail monitoring by installing extra analysis tools:

sudo apt install pflogsumm

This enhances Postfix reporting with detailed sender/recipient statistics and delivery performance metrics. Essential for customers managing multiple domains or high email volumes on their VPS hosting environment.

Review sample email reports to understand the information available. Look for authentication failures, unusual sending patterns, or delivery problems that could indicate security issues or configuration problems.

Troubleshoot Common Configuration Issues

Missing reports often result from email delivery problems rather than Logwatch failures. Check these common issues:

No emails arriving: Verify Postfix configuration and check spam folders. Test with a simple mail command: echo "Test" | mail -s "Test Subject" your-email@domain.com

Empty reports: Ensure log files have recent activity. New servers or recently installed services may have minimal log content. Run sudo logwatch --print to display reports without email delivery.

Permission errors: Logwatch requires read access to system logs. Verify the logwatch user can access /var/log directories: sudo -u logwatch ls -la /var/log/

Large report files: Reduce detail level or exclude verbose services. Apache access logs can generate enormous reports on busy servers.

Consider using "Service = -http" to exclude web server logs from daily summaries.

Monitor your email delivery reputation when sending automated reports. Configure SPF and DKIM records for your server domain to improve deliverability, especially important for Ubuntu VPS hosting customers managing their own email infrastructure.

Frequently Asked Questions

How much disk space do Logwatch reports consume?

Daily email reports typically range from 10KB to 500KB depending on system activity and detail level. The reports themselves don't consume significant storage, but archived emails in your inbox will accumulate over time. Consider automatic email filtering or periodic cleanup for long-term management.

Can I send reports to multiple administrators?

Yes, specify multiple email addresses in the MailTo setting using comma separation: MailTo = admin1@company.com,admin2@company.com. Alternatively, create separate configuration files for different recipient groups with varying detail levels.

Should I enable HTML format for better readability?

HTML format provides better visual organization and easier scanning of report sections. Enable with Format = html in your configuration. However, some email clients or security policies may prefer plain text format for automated system emails.

How do I exclude sensitive information from reports?

Use service exclusions and custom filters to remove sensitive data. Create custom service scripts in /etc/logwatch/scripts/services/ that filter out specific log entries before analysis. This approach maintains security while providing necessary monitoring information.

What happens if email delivery fails?

Failed email deliveries typically queue in Postfix for retry attempts. Check the mail queue with mailq and review /var/log/mail.log for delivery errors. Configure alternative delivery methods or backup notification systems for critical environments where monitoring email must reach administrators reliably.