Automated Log Reports with Logwatch on VPS

June 2026 · 6 min read

Logwatch reads all log files on your server every day and sends an email report summarizing what happened — including SSH login attempts, Nginx errors, sudo usage, disk warnings, and more. This allows sysadmins to spot anomalies without manually SSH-ing into the server to check logs every single day. It's the minimum viable monitoring every VPS should have.

Install Logwatch and Mail Transfer Agent

sudo apt update
sudo apt install logwatch mailutils postfix -y

# When postfix asks about configuration:
# Select "Internet Site" (if you want to send email from this server)
# Or "Satellite system" (if relaying through external SMTP)

# Verify logwatch installation
logwatch --version

Configure Logwatch

sudo nano /etc/logwatch/conf/logwatch.conf

# Recipient email address
MailTo = [email protected]
MailFrom = [email protected]

# Detail level: Low, Med, High
Detail = Med

# Time range: Today, Yesterday, All
Range = Yesterday

# Output: mail, stdout, file
Output = mail

# Service to analyze (All = everything)
Service = All

# Exclude specific services
Service = "-zz-sys"

Test Sending a Report Immediately

# Send report to email
sudo logwatch --mailto [email protected] --detail Med --range yesterday

# View output in terminal instead of sending email
sudo logwatch --output stdout --detail Med --range yesterday

Configure SMTP Relay via Gmail/SMTP

sudo nano /etc/postfix/main.cf

relayhost = [smtp.gmail.com]:587
smtp_use_tls = yes
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_sasl_security_options = noanonymous
smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt

sudo nano /etc/postfix/sasl_passwd
[smtp.gmail.com]:587 [email protected]:your_app_password

sudo postmap /etc/postfix/sasl_passwd
sudo chmod 600 /etc/postfix/sasl_passwd
sudo systemctl restart postfix

Configure Cron for Daily Sending

# Logwatch usually sets up a cron job automatically
cat /etc/cron.daily/00logwatch

# If not present, create one manually:
sudo nano /etc/cron.d/logwatch
# Send report every day at 07:00
0 7 * * * root /usr/sbin/logwatch --mailto [email protected] --detail Med

Tip: Set Detail to High for servers you want to monitor closely, and Low for stable servers where you just want a summary without noise.

Verify Logwatch is Working Correctly

# Test output as plain text
sudo logwatch --output stdout --detail Low --range today

# Check postfix mail queue
mailq

# View mail logs
sudo tail -f /var/log/mail.log

# Test sending email
echo "test" | mail -s "Test from VPS" [email protected]

Tip: If emails aren't arriving, check your spam folder first, then look at /var/log/mail.log for errors like SMTP authentication failed or connection refused.

Common Issues & Troubleshooting

Email Not Sending (Postfix Queue Stuck)

Check the postfix queue and force delivery:

mailq
sudo postqueue -f
sudo postfix flush
sudo tail -50 /var/log/mail.log

Gmail Rejecting SMTP Authentication

You must use an App Password instead of your Google account password because of 2FA:

# Google Account > Security > 2-Step Verification > App passwords
# Generate an App Password for "Mail" > "Linux computer"
# Use that password in sasl_passwd

Logwatch Report is Empty (No Data)

Log files might be using systemd journal instead of traditional syslog. You need to configure the journal to write to a file:

sudo nano /etc/systemd/journald.conf
[Journal]
Storage=persistent

sudo systemctl restart systemd-journald

Report Shows Abnormally High SSH Failed Login Count

This is a sign of brute force attack and you should install fail2ban immediately:

sudo apt install fail2ban -y
sudo systemctl enable --now fail2ban

Frequently Asked Questions

How is Logwatch different from Graylog/ELK Stack?

Logwatch is a simple daily digest email with no real-time alerting or dashboard. Graylog/ELK is an enterprise logging platform that performs real-time analysis. Logwatch is ideal for a single VPS where you want minimal overhead.

What logs does Logwatch read?

It reads /var/log/syslog, auth.log, nginx/apache access and error logs, mail.log, dpkg.log, kernel, cron, sudo logs, and service-specific logs through service scripts in /usr/share/logwatch/scripts/services/

Can I add custom log analysis?

Yes. Create a custom service script in /etc/logwatch/scripts/services/ — write a Perl script that reads log lines from stdin and outputs a summary to stdout. Logwatch will automatically include it in the daily report.